Taint: fix parsing of ACL ratelimit condition
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08 24static uschar *verbs[] = {
f2ed27cf
JH
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32};
059ec3d9 33
4e88a19f
PH
34/* For each verb, the conditions for which "message" or "log_message" are used
35are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36"accept", the FAIL case is used only after "endpass", but that is selected in
37the code. */
38
39static int msgcond[] = {
e3a69b62
JH
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
4e88a19f 47 };
059ec3d9
PH
48
49/* ACL condition and modifier codes - keep in step with the table that
2d009132 50follows.
71fafd95 51down. */
059ec3d9 52
71fafd95
PH
53enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
8523533c
TK
56#ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58#endif
71fafd95 59 ACLC_CONDITION,
c3611384 60 ACLC_CONTINUE,
71fafd95 61 ACLC_CONTROL,
6a8f9482
TK
62#ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64#endif
8523533c
TK
65#ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67#endif
68 ACLC_DELAY,
80a47a2c
TK
69#ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
fb2274d4 72#endif
1a2e76e1 73#ifdef SUPPORT_DMARC
4840604e
TL
74 ACLC_DMARC_STATUS,
75#endif
71fafd95
PH
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
6ea85e9a 83 ACLC_LOG_REJECT_TARGET,
71fafd95 84 ACLC_LOGWRITE,
8523533c
TK
85#ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87#endif
88 ACLC_MESSAGE,
89#ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91#endif
b0b9dbb1 92 ACLC_QUEUE,
870f6ba8 93 ACLC_RATELIMIT,
8523533c
TK
94 ACLC_RECIPIENTS,
95#ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97#endif
e7568d51 98 ACLC_REMOVE_HEADER,
71fafd95
PH
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
8523533c 102#ifdef WITH_CONTENT_SCAN
8e669ac1 103 ACLC_SPAM,
8523533c 104#endif
7952eef9 105#ifdef SUPPORT_SPF
8523533c 106 ACLC_SPF,
65a7d8c3 107 ACLC_SPF_GUESS,
8523533c 108#endif
b0019c78 109 ACLC_UDPSEND,
8523533c 110 ACLC_VERIFY };
059ec3d9 111
c3611384 112/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 113"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384 114modifiers that look like conditions but always return TRUE. They are used for
cfe6f17c
JH
115their side effects. Do not invent new modifier names that result in one name
116being the prefix of another; the binary-search in the list will go wrong. */
059ec3d9 117
2d009132
JH
118typedef struct condition_def {
119 uschar *name;
c5fcb476 120
2d009132 121/* Flag to indicate the condition/modifier has a string expansion done
059ec3d9
PH
122at the outer level. In the other cases, expansion already occurs in the
123checking functions. */
2d009132 124 BOOL expand_at_top:1;
059ec3d9 125
2d009132 126 BOOL is_modifier:1;
059ec3d9 127
2d009132
JH
128/* Bit map vector of which conditions and modifiers are not allowed at certain
129times. For each condition and modifier, there's a bitmap of dis-allowed times.
130For some, it is easier to specify the negation of a small number of allowed
131times. */
132 unsigned forbids;
133
134} condition_def;
135
136static condition_def conditions[] = {
f2ed27cf 137 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
2d009132 138
f2ed27cf
JH
139 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
140 (unsigned int)
e3a69b62
JH
141 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
142 ACL_BIT_PREDATA | ACL_BIT_DATA |
2d009132 143#ifndef DISABLE_PRDR
e3a69b62 144 ACL_BIT_PRDR |
2d009132 145#endif
e3a69b62
JH
146 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
147 ACL_BIT_DKIM |
148 ACL_BIT_NOTSMTP_START),
2d009132 149 },
059ec3d9 150
f2ed27cf 151 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
e3a69b62
JH
152 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
153 ACL_BIT_CONNECT | ACL_BIT_HELO,
2d009132 154 },
8523533c 155#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf 156 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
e3a69b62
JH
157 ACL_BIT_AUTH |
158 ACL_BIT_CONNECT | ACL_BIT_HELO |
159 ACL_BIT_DATA | ACL_BIT_MIME |
2d009132 160# ifndef DISABLE_PRDR
e3a69b62 161 ACL_BIT_PRDR |
2d009132 162# endif
e3a69b62
JH
163 ACL_BIT_ETRN | ACL_BIT_EXPN |
164 ACL_BIT_MAILAUTH |
165 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
166 ACL_BIT_VRFY | ACL_BIT_PREDATA |
167 ACL_BIT_NOTSMTP_START,
2d009132 168 },
8e669ac1 169#endif
f2ed27cf
JH
170 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
171 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
2d009132
JH
172
173 /* Certain types of control are always allowed, so we let it through
174 always and check in the control processing itself. */
f2ed27cf 175 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
2d009132 176
6a8f9482 177#ifdef EXPERIMENTAL_DCC
f2ed27cf
JH
178 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
179 (unsigned int)
e3a69b62 180 ~(ACL_BIT_DATA |
2d009132 181# ifndef DISABLE_PRDR
e3a69b62 182 ACL_BIT_PRDR |
2d009132 183# endif
e3a69b62 184 ACL_BIT_NOTSMTP),
2d009132 185 },
6a8f9482 186#endif
8523533c 187#ifdef WITH_CONTENT_SCAN
e3a69b62 188 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
2d009132 189
8523533c 190#endif
e3a69b62 191 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
80a47a2c 192#ifndef DISABLE_DKIM
e3a69b62
JH
193 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
194 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
fb2274d4 195#endif
1a2e76e1 196#ifdef SUPPORT_DMARC
e3a69b62 197 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
4840604e 198#endif
059ec3d9 199
2d009132
JH
200 /* Explicit key lookups can be made in non-smtp ACLs so pass
201 always and check in the verify processing itself. */
f2ed27cf 202 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
c3611384 203
f2ed27cf
JH
204 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
205 (unsigned int)
e3a69b62 206 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
2d009132 207#ifndef DISABLE_PRDR
e3a69b62 208 |ACL_BIT_PRDR
2d009132
JH
209#endif
210 ),
211 },
f2ed27cf 212 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
e3a69b62
JH
213 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
214 ACL_BIT_HELO,
2d009132 215 },
8e669ac1 216
f2ed27cf 217 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
8e669ac1 218
f2ed27cf 219 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
e3a69b62 220 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132 221 },
f2ed27cf
JH
222 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
223 (unsigned int)
e3a69b62 224 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
f2ed27cf 225#ifndef DISABLE_PRDR
e3a69b62 226 | ACL_BIT_PRDR
f2ed27cf 227#endif
2d009132
JH
228 ),
229 },
6a8f9482 230
f2ed27cf 231 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
e3a69b62 232 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
f2ed27cf 233 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
8523533c 234
2d009132 235#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
236 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
237 (unsigned int)
e3a69b62 238 ~(ACL_BIT_DATA |
2d009132 239# ifndef DISABLE_PRDR
e3a69b62 240 ACL_BIT_PRDR |
2d009132 241# endif
e3a69b62 242 ACL_BIT_NOTSMTP),
2d009132
JH
243 },
244#endif
8e669ac1 245
f2ed27cf 246 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
2d009132 247#ifdef WITH_CONTENT_SCAN
e3a69b62 248 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
2d009132 249#endif
84330b7b 250
f2ed27cf 251 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
e3a69b62 252 ACL_BIT_NOTSMTP |
2d009132 253#ifndef DISABLE_PRDR
e3a69b62 254 ACL_BIT_PRDR |
2d009132 255#endif
e3a69b62 256 ACL_BIT_DATA,
2d009132 257 },
fb2274d4 258
f2ed27cf 259 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
e3a69b62 260 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
4840604e 261
2d009132 262#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
263 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
264 (unsigned int)
e3a69b62 265 ~(ACL_BIT_DATA |
2d009132 266# ifndef DISABLE_PRDR
e3a69b62 267 ACL_BIT_PRDR |
2d009132 268# endif
e3a69b62
JH
269 ACL_BIT_NOTSMTP |
270 ACL_BIT_MIME),
2d009132 271 },
379ba7d0 272
2d009132 273#endif
f2ed27cf
JH
274 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
275 (unsigned int)
e3a69b62
JH
276 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
277 ACL_BIT_PREDATA | ACL_BIT_DATA |
2d009132 278#ifndef DISABLE_PRDR
e3a69b62 279 ACL_BIT_PRDR |
2d009132 280#endif
e3a69b62
JH
281 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
282 ACL_BIT_NOTSMTP_START),
2d009132 283 },
f2ed27cf 284 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
e3a69b62
JH
285 ACL_BIT_AUTH | ACL_BIT_CONNECT |
286 ACL_BIT_HELO |
287 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
288 ACL_BIT_ETRN | ACL_BIT_EXPN |
289 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
2d009132 290 },
f2ed27cf 291 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
e3a69b62
JH
292 ACL_BIT_AUTH | ACL_BIT_CONNECT |
293 ACL_BIT_HELO |
294 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
295 ACL_BIT_ETRN | ACL_BIT_EXPN |
296 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
2d009132 297 },
65a7d8c3 298
f2ed27cf 299 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
8523533c 300
2d009132 301#ifdef WITH_CONTENT_SCAN
f2ed27cf 302 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
e3a69b62 303 (unsigned int) ~(ACL_BIT_DATA |
2d009132 304# ifndef DISABLE_PRDR
e3a69b62 305 ACL_BIT_PRDR |
2d009132 306# endif
e3a69b62 307 ACL_BIT_NOTSMTP),
2d009132
JH
308 },
309#endif
7952eef9 310#ifdef SUPPORT_SPF
f2ed27cf 311 [ACLC_SPF] = { US"spf", TRUE, FALSE,
e3a69b62
JH
312 ACL_BIT_AUTH | ACL_BIT_CONNECT |
313 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
314 ACL_BIT_ETRN | ACL_BIT_EXPN |
315 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
316 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132 317 },
6e1a8743 318 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
e3a69b62
JH
319 ACL_BIT_AUTH | ACL_BIT_CONNECT |
320 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
321 ACL_BIT_ETRN | ACL_BIT_EXPN |
322 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
323 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132
JH
324 },
325#endif
f2ed27cf 326 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
b0019c78 327
059ec3d9
PH
328 /* Certain types of verify are always allowed, so we let it through
329 always and check in the verify function itself */
f2ed27cf 330 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
059ec3d9
PH
331};
332
333
2d009132 334
d7bed771
JH
335/* Return values from decode_control(); used as index so keep in step
336with the controls_list table that follows! */
c46782ef 337
d7bed771
JH
338enum {
339 CONTROL_AUTH_UNADVERTISED,
3c8b3577 340#ifdef EXPERIMENTAL_BRIGHTMAIL
d7bed771 341 CONTROL_BMI_RUN,
3c8b3577 342#endif
d7bed771
JH
343 CONTROL_CASEFUL_LOCAL_PART,
344 CONTROL_CASELOWER_LOCAL_PART,
345 CONTROL_CUTTHROUGH_DELIVERY,
346 CONTROL_DEBUG,
3c8b3577 347#ifndef DISABLE_DKIM
d7bed771 348 CONTROL_DKIM_VERIFY,
3c8b3577 349#endif
1a2e76e1 350#ifdef SUPPORT_DMARC
d7bed771
JH
351 CONTROL_DMARC_VERIFY,
352 CONTROL_DMARC_FORENSIC,
3c8b3577 353#endif
d7bed771
JH
354 CONTROL_DSCP,
355 CONTROL_ENFORCE_SYNC,
356 CONTROL_ERROR, /* pseudo-value for decode errors */
357 CONTROL_FAKEDEFER,
358 CONTROL_FAKEREJECT,
359 CONTROL_FREEZE,
4840604e 360
d7bed771
JH
361 CONTROL_NO_CALLOUT_FLUSH,
362 CONTROL_NO_DELAY_FLUSH,
363 CONTROL_NO_ENFORCE_SYNC,
3c8b3577 364#ifdef WITH_CONTENT_SCAN
d7bed771 365 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 366#endif
d7bed771
JH
367 CONTROL_NO_MULTILINE,
368 CONTROL_NO_PIPELINING,
8523533c 369
9438970c 370 CONTROL_QUEUE,
d7bed771
JH
371 CONTROL_SUBMISSION,
372 CONTROL_SUPPRESS_LOCAL_FIXUPS,
8c5d388a 373#ifdef SUPPORT_I18N
d7bed771 374 CONTROL_UTF8_DOWNCONVERT,
3c8b3577 375#endif
d7bed771 376};
3c8b3577 377
4c590bd1 378
c5fcb476 379
d7bed771
JH
380/* Structure listing various control arguments, with their characteristics.
381For each control, there's a bitmap of dis-allowed times. For some, it is easier
382to specify the negation of a small number of allowed times. */
059ec3d9
PH
383
384typedef struct control_def {
d7bed771
JH
385 uschar *name;
386 BOOL has_option; /* Has /option(s) following */
387 unsigned forbids; /* bitmap of dis-allowed times */
059ec3d9
PH
388} control_def;
389
390static control_def controls_list[] = {
f2ed27cf
JH
391 /* name has_option forbids */
392[CONTROL_AUTH_UNADVERTISED] =
d7bed771 393 { US"allow_auth_unadvertised", FALSE,
f2ed27cf 394 (unsigned)
e3a69b62 395 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
d7bed771 396 },
8523533c 397#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf
JH
398[CONTROL_BMI_RUN] =
399 { US"bmi_run", FALSE, 0 },
8523533c 400#endif
f2ed27cf 401[CONTROL_CASEFUL_LOCAL_PART] =
e3a69b62 402 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
f2ed27cf 403[CONTROL_CASELOWER_LOCAL_PART] =
e3a69b62 404 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
f2ed27cf
JH
405[CONTROL_CUTTHROUGH_DELIVERY] =
406 { US"cutthrough_delivery", TRUE, 0 },
407[CONTROL_DEBUG] =
408 { US"debug", TRUE, 0 },
d7bed771 409
80a47a2c 410#ifndef DISABLE_DKIM
f2ed27cf 411[CONTROL_DKIM_VERIFY] =
d7bed771 412 { US"dkim_disable_verify", FALSE,
e3a69b62 413 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
d7bed771 414# ifndef DISABLE_PRDR
e3a69b62 415 ACL_BIT_PRDR |
d7bed771 416# endif
e3a69b62 417 ACL_BIT_NOTSMTP_START
d7bed771 418 },
f7572e5a 419#endif
d7bed771 420
1a2e76e1 421#ifdef SUPPORT_DMARC
9904d08c 422[CONTROL_DMARC_VERIFY] =
d7bed771 423 { US"dmarc_disable_verify", FALSE,
e3a69b62 424 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 425 },
9904d08c 426[CONTROL_DMARC_FORENSIC] =
d7bed771 427 { US"dmarc_enable_forensic", FALSE,
e3a69b62 428 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
429 },
430#endif
431
f2ed27cf 432[CONTROL_DSCP] =
d7bed771 433 { US"dscp", TRUE,
e3a69b62 434 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
d7bed771 435 },
f2ed27cf 436[CONTROL_ENFORCE_SYNC] =
d7bed771 437 { US"enforce_sync", FALSE,
e3a69b62 438 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
439 },
440
441 /* Pseudo-value for decode errors */
f2ed27cf 442[CONTROL_ERROR] =
d7bed771
JH
443 { US"error", FALSE, 0 },
444
f2ed27cf 445[CONTROL_FAKEDEFER] =
d7bed771 446 { US"fakedefer", TRUE,
f2ed27cf 447 (unsigned)
e3a69b62
JH
448 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
449 ACL_BIT_PREDATA | ACL_BIT_DATA |
d7bed771 450#ifndef DISABLE_PRDR
e3a69b62 451 ACL_BIT_PRDR |
d7bed771 452#endif
e3a69b62 453 ACL_BIT_MIME)
d7bed771 454 },
f2ed27cf 455[CONTROL_FAKEREJECT] =
d7bed771 456 { US"fakereject", TRUE,
f2ed27cf 457 (unsigned)
e3a69b62
JH
458 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
459 ACL_BIT_PREDATA | ACL_BIT_DATA |
d7bed771 460#ifndef DISABLE_PRDR
e3a69b62 461 ACL_BIT_PRDR |
d7bed771 462#endif
e3a69b62 463 ACL_BIT_MIME)
d7bed771 464 },
f2ed27cf 465[CONTROL_FREEZE] =
d7bed771 466 { US"freeze", TRUE,
f2ed27cf 467 (unsigned)
e3a69b62
JH
468 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
469 ACL_BIT_PREDATA | ACL_BIT_DATA |
470 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
471 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
d7bed771
JH
472 },
473
f2ed27cf 474[CONTROL_NO_CALLOUT_FLUSH] =
d7bed771 475 { US"no_callout_flush", FALSE,
e3a69b62 476 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 477 },
f2ed27cf 478[CONTROL_NO_DELAY_FLUSH] =
d7bed771 479 { US"no_delay_flush", FALSE,
e3a69b62 480 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
481 },
482
f2ed27cf 483[CONTROL_NO_ENFORCE_SYNC] =
d7bed771 484 { US"no_enforce_sync", FALSE,
e3a69b62 485 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 486 },
8523533c 487#ifdef WITH_CONTENT_SCAN
f2ed27cf 488[CONTROL_NO_MBOX_UNSPOOL] =
d7bed771 489 { US"no_mbox_unspool", FALSE,
f2ed27cf 490 (unsigned)
e3a69b62
JH
491 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
492 ACL_BIT_PREDATA | ACL_BIT_DATA |
493 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
494 ACL_BIT_MIME)
d7bed771
JH
495 },
496#endif
f2ed27cf 497[CONTROL_NO_MULTILINE] =
d7bed771 498 { US"no_multiline_responses", FALSE,
e3a69b62 499 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 500 },
f2ed27cf 501[CONTROL_NO_PIPELINING] =
d7bed771 502 { US"no_pipelining", FALSE,
e3a69b62 503 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
504 },
505
9438970c
JH
506[CONTROL_QUEUE] =
507 { US"queue", TRUE,
508 (unsigned)
509 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
510 ACL_BIT_PREDATA | ACL_BIT_DATA |
511 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
512 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
513 },
8ac90765 514
f2ed27cf 515[CONTROL_SUBMISSION] =
d7bed771 516 { US"submission", TRUE,
f2ed27cf 517 (unsigned)
e3a69b62 518 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
d7bed771 519 },
f2ed27cf 520[CONTROL_SUPPRESS_LOCAL_FIXUPS] =
d7bed771
JH
521 { US"suppress_local_fixups", FALSE,
522 (unsigned)
e3a69b62
JH
523 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
524 ACL_BIT_NOTSMTP_START)
d7bed771 525 },
8c5d388a 526#ifdef SUPPORT_I18N
f2ed27cf 527[CONTROL_UTF8_DOWNCONVERT] =
6741531c
JH
528 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
529 }
3c8b3577 530#endif
d7bed771 531};
059ec3d9 532
e5a9dba6
PH
533/* Support data structures for Client SMTP Authorization. acl_verify_csa()
534caches its result in a tree to avoid repeated DNS queries. The result is an
535integer code which is used as an index into the following tables of
536explanatory strings and verification return codes. */
537
538static tree_node *csa_cache = NULL;
539
540enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
541 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
542
543/* The acl_verify_csa() return code is translated into an acl_verify() return
544code using the following table. It is OK unless the client is definitely not
545authorized. This is because CSA is supposed to be optional for sending sites,
546so recipients should not be too strict about checking it - especially because
547DNS problems are quite likely to occur. It's possible to use $csa_status in
548further ACL conditions to distinguish ok, unknown, and defer if required, but
549the aim is to make the usual configuration simple. */
550
551static int csa_return_code[] = {
f2ed27cf
JH
552 [CSA_UNKNOWN] = OK,
553 [CSA_OK] = OK,
554 [CSA_DEFER_SRV] = OK,
555 [CSA_DEFER_ADDR] = OK,
556 [CSA_FAIL_EXPLICIT] = FAIL,
557 [CSA_FAIL_DOMAIN] = FAIL,
558 [CSA_FAIL_NOADDR] = FAIL,
559 [CSA_FAIL_MISMATCH] = FAIL
e5a9dba6
PH
560};
561
562static uschar *csa_status_string[] = {
f2ed27cf
JH
563 [CSA_UNKNOWN] = US"unknown",
564 [CSA_OK] = US"ok",
565 [CSA_DEFER_SRV] = US"defer",
566 [CSA_DEFER_ADDR] = US"defer",
567 [CSA_FAIL_EXPLICIT] = US"fail",
568 [CSA_FAIL_DOMAIN] = US"fail",
569 [CSA_FAIL_NOADDR] = US"fail",
570 [CSA_FAIL_MISMATCH] = US"fail"
e5a9dba6
PH
571};
572
573static uschar *csa_reason_string[] = {
f2ed27cf
JH
574 [CSA_UNKNOWN] = US"unknown",
575 [CSA_OK] = US"ok",
576 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
577 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
578 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
579 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
580 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
581 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
e5a9dba6
PH
582};
583
c99ce5c9
TF
584/* Options for the ratelimit condition. Note that there are two variants of
585the per_rcpt option, depending on the ACL that is used to measure the rate.
586However any ACL must be able to look up per_rcpt rates in /noupdate mode,
587so the two variants must have the same internal representation as well as
588the same configuration string. */
589
590enum {
591 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
592 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
593};
594
595#define RATE_SET(var,new) \
596 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
597
598static uschar *ratelimit_option_string[] = {
f2ed27cf
JH
599 [RATE_PER_WHAT] = US"?",
600 [RATE_PER_CLASH] = US"!",
601 [RATE_PER_ADDR] = US"per_addr",
602 [RATE_PER_BYTE] = US"per_byte",
603 [RATE_PER_CMD] = US"per_cmd",
604 [RATE_PER_CONN] = US"per_conn",
605 [RATE_PER_MAIL] = US"per_mail",
606 [RATE_PER_RCPT] = US"per_rcpt",
607 [RATE_PER_ALLRCPTS] = US"per_rcpt"
c99ce5c9
TF
608};
609
059ec3d9
PH
610/* Enable recursion between acl_check_internal() and acl_check_condition() */
611
e1d04f48 612static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
f60d98e8 613 uschar **);
059ec3d9
PH
614
615
616/*************************************************
d7bed771
JH
617* Find control in list *
618*************************************************/
619
620/* The lists are always in order, so binary chop can be used.
621
622Arguments:
623 name the control name to search for
624 ol the first entry in the control list
625 last one more than the offset of the last entry in the control list
626
627Returns: index of a control entry, or -1 if not found
628*/
629
630static int
631find_control(const uschar * name, control_def * ol, int last)
632{
d7978c0f 633for (int first = 0; last > first; )
d7bed771
JH
634 {
635 int middle = (first + last)/2;
636 uschar * s = ol[middle].name;
637 int c = Ustrncmp(name, s, Ustrlen(s));
638 if (c == 0) return middle;
639 else if (c > 0) first = middle + 1;
640 else last = middle;
641 }
642return -1;
643}
644
645
646
647/*************************************************
2d009132
JH
648* Pick out condition from list *
649*************************************************/
650
651/* Use a binary chop method
652
653Arguments:
654 name name to find
655 list list of conditions
656 end size of list
657
658Returns: offset in list, or -1 if not found
659*/
660
661static int
662acl_checkcondition(uschar * name, condition_def * list, int end)
663{
d7978c0f 664for (int start = 0; start < end; )
2d009132
JH
665 {
666 int mid = (start + end)/2;
667 int c = Ustrcmp(name, list[mid].name);
668 if (c == 0) return mid;
669 if (c < 0) end = mid;
670 else start = mid + 1;
671 }
672return -1;
673}
674
675
676/*************************************************
059ec3d9
PH
677* Pick out name from list *
678*************************************************/
679
680/* Use a binary chop method
681
682Arguments:
683 name name to find
684 list list of names
685 end size of list
686
687Returns: offset in list, or -1 if not found
688*/
689
690static int
691acl_checkname(uschar *name, uschar **list, int end)
692{
d7978c0f 693for (int start = 0; start < end; )
059ec3d9
PH
694 {
695 int mid = (start + end)/2;
696 int c = Ustrcmp(name, list[mid]);
697 if (c == 0) return mid;
698 if (c < 0) end = mid; else start = mid + 1;
699 }
700
701return -1;
702}
703
704
705/*************************************************
706* Read and parse one ACL *
707*************************************************/
708
709/* This function is called both from readconf in order to parse the ACLs in the
710configuration file, and also when an ACL is encountered dynamically (e.g. as
711the result of an expansion). It is given a function to call in order to
712retrieve the lines of the ACL. This function handles skipping comments and
713blank lines (where relevant).
714
715Arguments:
716 func function to get next line of ACL
717 error where to put an error message
718
719Returns: pointer to ACL, or NULL
720 NULL can be legal (empty ACL); in this case error will be NULL
721*/
722
723acl_block *
724acl_read(uschar *(*func)(void), uschar **error)
725{
726acl_block *yield = NULL;
727acl_block **lastp = &yield;
728acl_block *this = NULL;
729acl_condition_block *cond;
730acl_condition_block **condp = NULL;
d7978c0f 731uschar * s;
059ec3d9
PH
732
733*error = NULL;
734
137ae145 735while ((s = (*func)()))
059ec3d9
PH
736 {
737 int v, c;
738 BOOL negated = FALSE;
739 uschar *saveline = s;
740 uschar name[64];
741
742 /* Conditions (but not verbs) are allowed to be negated by an initial
743 exclamation mark. */
744
137ae145 745 if (Uskip_whitespace(&s) == '!')
059ec3d9
PH
746 {
747 negated = TRUE;
748 s++;
749 }
750
cf00dad6
PH
751 /* Read the name of a verb or a condition, or the start of a new ACL, which
752 can be started by a name, or by a macro definition. */
059ec3d9
PH
753
754 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 755 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
756
757 /* If a verb is unrecognized, it may be another condition or modifier that
758 continues the previous verb. */
759
2d009132 760 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
059ec3d9 761 {
897024f1 762 if (!this)
059ec3d9 763 {
4e167a8c
PH
764 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
765 saveline);
059ec3d9
PH
766 return NULL;
767 }
768 }
769
770 /* New verb */
771
772 else
773 {
774 if (negated)
775 {
776 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
777 return NULL;
778 }
f3ebb786 779 this = store_get(sizeof(acl_block), FALSE);
059ec3d9
PH
780 *lastp = this;
781 lastp = &(this->next);
782 this->next = NULL;
059ec3d9 783 this->condition = NULL;
897024f1
JH
784 this->verb = v;
785 this->srcline = config_lineno; /* for debug output */
786 this->srcfile = config_filename; /**/
059ec3d9
PH
787 condp = &(this->condition);
788 if (*s == 0) continue; /* No condition on this line */
789 if (*s == '!')
790 {
791 negated = TRUE;
792 s++;
793 }
794 s = readconf_readname(name, sizeof(name), s); /* Condition name */
795 }
796
797 /* Handle a condition or modifier. */
798
2d009132 799 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
059ec3d9
PH
800 {
801 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
802 saveline);
803 return NULL;
804 }
805
806 /* The modifiers may not be negated */
807
2d009132 808 if (negated && conditions[c].is_modifier)
059ec3d9
PH
809 {
810 *error = string_sprintf("ACL error: negation is not allowed with "
2d009132 811 "\"%s\"", conditions[c].name);
059ec3d9
PH
812 return NULL;
813 }
814
815 /* ENDPASS may occur only with ACCEPT or DISCARD. */
816
817 if (c == ACLC_ENDPASS &&
818 this->verb != ACL_ACCEPT &&
819 this->verb != ACL_DISCARD)
820 {
821 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
2d009132 822 conditions[c].name, verbs[this->verb]);
059ec3d9
PH
823 return NULL;
824 }
825
f3ebb786 826 cond = store_get(sizeof(acl_condition_block), FALSE);
059ec3d9
PH
827 cond->next = NULL;
828 cond->type = c;
829 cond->u.negated = negated;
830
831 *condp = cond;
832 condp = &(cond->next);
833
834 /* The "set" modifier is different in that its argument is "name=value"
835 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH
836 gives us a variable name to insert into the data block. The original ACL
837 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
838 extended to 20 of each type, but after that people successfully argued for
641cb756
PH
839 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
840 After that, we allow alphanumerics and underscores, but the first character
841 after c or m must be a digit or an underscore. This retains backwards
842 compatibility. */
059ec3d9
PH
843
844 if (c == ACLC_SET)
a79d8834
JH
845#ifndef DISABLE_DKIM
846 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
847 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
848 {
849 uschar * endptr = s+18;
850
851 if (isalnum(*endptr))
852 {
853 *error = string_sprintf("invalid variable name after \"set\" in ACL "
854 "modifier \"set %s\" "
855 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
856 s);
857 return NULL;
858 }
859 cond->u.varname = string_copyn(s, 18);
860 s = endptr;
137ae145 861 Uskip_whitespace(&s);
a79d8834
JH
862 }
863 else
864#endif
059ec3d9 865 {
47ca6d6c
PH
866 uschar *endptr;
867
163144aa 868 if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 869 {
38a0a95f 870 *error = string_sprintf("invalid variable name after \"set\" in ACL "
163144aa 871 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
38a0a95f 872 return NULL;
47ca6d6c 873 }
38a0a95f
PH
874
875 endptr = s + 5;
641cb756
PH
876 if (!isdigit(*endptr) && *endptr != '_')
877 {
878 *error = string_sprintf("invalid variable name after \"set\" in ACL "
163144aa
JH
879 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
880 s);
641cb756
PH
881 return NULL;
882 }
883
163144aa 884 while (*endptr && *endptr != '=' && !isspace(*endptr))
47ca6d6c 885 {
38a0a95f 886 if (!isalnum(*endptr) && *endptr != '_')
163144aa
JH
887 {
888 *error = string_sprintf("invalid character \"%c\" in variable name "
889 "in ACL modifier \"set %s\"", *endptr, s);
890 return NULL;
891 }
38a0a95f 892 endptr++;
47ca6d6c 893 }
47ca6d6c 894
38a0a95f 895 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 896 s = endptr;
137ae145 897 Uskip_whitespace(&s);
059ec3d9
PH
898 }
899
900 /* For "set", we are now positioned for the data. For the others, only
901 "endpass" has no data */
902
903 if (c != ACLC_ENDPASS)
904 {
905 if (*s++ != '=')
906 {
907 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
2d009132 908 conditions[c].is_modifier ? US"modifier" : US"condition");
059ec3d9
PH
909 return NULL;
910 }
137ae145 911 Uskip_whitespace(&s);
059ec3d9
PH
912 cond->arg = string_copy(s);
913 }
914 }
915
916return yield;
917}
918
919
920
921/*************************************************
71fafd95
PH
922* Set up added header line(s) *
923*************************************************/
924
925/* This function is called by the add_header modifier, and also from acl_warn()
926to implement the now-deprecated way of adding header lines using "message" on a
927"warn" verb. The argument is treated as a sequence of header lines which are
928added to a chain, provided there isn't an identical one already there.
929
930Argument: string of header lines
931Returns: nothing
932*/
933
934static void
55414b25 935setup_header(const uschar *hstring)
71fafd95 936{
55414b25 937const uschar *p, *q;
71fafd95
PH
938int hlen = Ustrlen(hstring);
939
b1b05573
JH
940/* Ignore any leading newlines */
941while (*hstring == '\n') hstring++, hlen--;
71fafd95 942
b1b05573 943/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 944if (hlen <= 0) return;
96f5fe4c 945if (hstring[--hlen] != '\n') /* no newline */
55414b25 946 q = string_sprintf("%s\n", hstring);
96f5fe4c 947else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH
948 {
949 uschar * s = string_copy(hstring);
950 while(s[--hlen] == '\n')
951 s[hlen+1] = '\0';
952 q = s;
953 }
954else
955 q = hstring;
71fafd95
PH
956
957/* Loop for multiple header lines, taking care about continuations */
958
617d3932 959for (p = q; *p; p = q)
71fafd95 960 {
55414b25
JH
961 const uschar *s;
962 uschar * hdr;
71fafd95
PH
963 int newtype = htype_add_bot;
964 header_line **hptr = &acl_added_headers;
965
966 /* Find next header line within the string */
967
968 for (;;)
969 {
96f5fe4c 970 q = Ustrchr(q, '\n'); /* we know there was a newline */
617d3932 971 if (*++q != ' ' && *q != '\t') break;
71fafd95
PH
972 }
973
974 /* If the line starts with a colon, interpret the instruction for where to
975 add it. This temporarily sets up a new type. */
976
977 if (*p == ':')
978 {
979 if (strncmpic(p, US":after_received:", 16) == 0)
980 {
981 newtype = htype_add_rec;
982 p += 16;
983 }
984 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
985 {
986 newtype = htype_add_rfc;
987 p += 14;
988 }
989 else if (strncmpic(p, US":at_start:", 10) == 0)
990 {
991 newtype = htype_add_top;
992 p += 10;
993 }
994 else if (strncmpic(p, US":at_end:", 8) == 0)
995 {
996 newtype = htype_add_bot;
997 p += 8;
998 }
999 while (*p == ' ' || *p == '\t') p++;
1000 }
1001
1002 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1003 to the front of it. */
1004
1005 for (s = p; s < q - 1; s++)
71fafd95 1006 if (*s == ':' || !isgraph(*s)) break;
71fafd95 1007
617d3932 1008 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
55414b25 1009 hlen = Ustrlen(hdr);
71fafd95
PH
1010
1011 /* See if this line has already been added */
1012
617d3932 1013 while (*hptr)
71fafd95 1014 {
55414b25 1015 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
617d3932 1016 hptr = &(*hptr)->next;
71fafd95
PH
1017 }
1018
1019 /* Add if not previously present */
1020
617d3932 1021 if (!*hptr)
71fafd95 1022 {
f3ebb786 1023 /* The header_line struct itself is not tainted, though it points to
ba5120a4
JH
1024 possibly tainted data. */
1025 header_line * h = store_get(sizeof(header_line), FALSE);
55414b25 1026 h->text = hdr;
71fafd95
PH
1027 h->next = NULL;
1028 h->type = newtype;
1029 h->slen = hlen;
1030 *hptr = h;
617d3932 1031 hptr = &h->next;
71fafd95 1032 }
71fafd95
PH
1033 }
1034}
1035
1036
1037
e7568d51 1038/*************************************************
362145b5
JH
1039* List the added header lines *
1040*************************************************/
1041uschar *
1042fn_hdrs_added(void)
1043{
acec9514 1044gstring * g = NULL;
362145b5 1045
d7978c0f 1046for (header_line * h = acl_added_headers; h; h = h->next)
362145b5 1047 {
bce15b62
JH
1048 int i = h->slen;
1049 if (h->text[i-1] == '\n') i--;
1050 g = string_append_listele_n(g, '\n', h->text, i);
362145b5 1051 }
362145b5 1052
bce15b62 1053return g ? g->s : NULL;
362145b5
JH
1054}
1055
1056
1057/*************************************************
e7568d51
TL
1058* Set up removed header line(s) *
1059*************************************************/
1060
1061/* This function is called by the remove_header modifier. The argument is
1062treated as a sequence of header names which are added to a colon separated
1063list, provided there isn't an identical one already there.
1064
1065Argument: string of header names
1066Returns: nothing
1067*/
1068
1069static void
55414b25 1070setup_remove_header(const uschar *hnames)
e7568d51 1071{
48334568 1072if (*hnames)
55414b25
JH
1073 acl_removed_headers = acl_removed_headers
1074 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1075 : string_copy(hnames);
e7568d51
TL
1076}
1077
1078
71fafd95
PH
1079
1080/*************************************************
059ec3d9
PH
1081* Handle warnings *
1082*************************************************/
1083
1084/* This function is called when a WARN verb's conditions are true. It adds to
1085the message's headers, and/or writes information to the log. In each case, this
1086only happens once (per message for headers, per connection for log).
1087
71fafd95
PH
1088** NOTE: The header adding action using the "message" setting is historic, and
1089its use is now deprecated. The new add_header modifier should be used instead.
1090
059ec3d9
PH
1091Arguments:
1092 where ACL_WHERE_xxxx indicating which ACL this is
1093 user_message message for adding to headers
1094 log_message message for logging, if different
1095
1096Returns: nothing
1097*/
1098
1099static void
1100acl_warn(int where, uschar *user_message, uschar *log_message)
1101{
059ec3d9
PH
1102if (log_message != NULL && log_message != user_message)
1103 {
1104 uschar *text;
1105 string_item *logged;
1106
1107 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1108 string_printing(log_message));
1109
1110 /* If a sender verification has failed, and the log message is "sender verify
1111 failed", add the failure message. */
1112
1113 if (sender_verified_failed != NULL &&
1114 sender_verified_failed->message != NULL &&
1115 strcmpic(log_message, US"sender verify failed") == 0)
1116 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1117
9c7a242c
PH
1118 /* Search previously logged warnings. They are kept in malloc
1119 store so they can be freed at the start of a new message. */
059ec3d9 1120
d7978c0f 1121 for (logged = acl_warn_logged; logged; logged = logged->next)
059ec3d9
PH
1122 if (Ustrcmp(logged->text, text) == 0) break;
1123
d7978c0f 1124 if (!logged)
059ec3d9
PH
1125 {
1126 int length = Ustrlen(text) + 1;
1127 log_write(0, LOG_MAIN, "%s", text);
1128 logged = store_malloc(sizeof(string_item) + length);
5903c6ff 1129 logged->text = US logged + sizeof(string_item);
059ec3d9
PH
1130 memcpy(logged->text, text, length);
1131 logged->next = acl_warn_logged;
1132 acl_warn_logged = logged;
1133 }
1134 }
1135
1136/* If there's no user message, we are done. */
1137
d7978c0f 1138if (!user_message) return;
059ec3d9
PH
1139
1140/* If this isn't a message ACL, we can't do anything with a user message.
1141Log an error. */
1142
1143if (where > ACL_WHERE_NOTSMTP)
1144 {
1145 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1146 "found in a non-message (%s) ACL: cannot specify header lines here: "
1147 "message ignored", acl_wherenames[where]);
1148 return;
1149 }
1150
71fafd95
PH
1151/* The code for setting up header lines is now abstracted into a separate
1152function so that it can be used for the add_header modifier as well. */
059ec3d9 1153
71fafd95 1154setup_header(user_message);
059ec3d9
PH
1155}
1156
1157
1158
1159/*************************************************
1160* Verify and check reverse DNS *
1161*************************************************/
1162
1163/* Called from acl_verify() below. We look up the host name(s) of the client IP
1164address if this has not yet been done. The host_name_lookup() function checks
1165that one of these names resolves to an address list that contains the client IP
1166address, so we don't actually have to do the check here.
1167
1168Arguments:
1169 user_msgptr pointer for user message
1170 log_msgptr pointer for log message
1171
1172Returns: OK verification condition succeeded
1173 FAIL verification failed
1174 DEFER there was a problem verifying
1175*/
1176
1177static int
1178acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1179{
1180int rc;
1181
1182user_msgptr = user_msgptr; /* stop compiler warning */
1183
1184/* Previous success */
1185
1186if (sender_host_name != NULL) return OK;
1187
1188/* Previous failure */
1189
1190if (host_lookup_failed)
1191 {
1192 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1193 return FAIL;
1194 }
1195
1196/* Need to do a lookup */
1197
1198HDEBUG(D_acl)
e1d04f48 1199 debug_printf_indent("looking up host name to force name/address consistency check\n");
059ec3d9
PH
1200
1201if ((rc = host_name_lookup()) != OK)
1202 {
d7978c0f
JH
1203 *log_msgptr = rc == DEFER
1204 ? US"host lookup deferred for reverse lookup check"
1205 : string_sprintf("host lookup failed for reverse lookup check%s",
1206 host_lookup_msg);
059ec3d9
PH
1207 return rc; /* DEFER or FAIL */
1208 }
1209
1210host_build_sender_fullhost();
1211return OK;
1212}
1213
1214
1215
1216/*************************************************
e5a9dba6
PH
1217* Check client IP address matches CSA target *
1218*************************************************/
1219
1220/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1221response for address records belonging to the CSA target hostname. The section
1222is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1223If one of the addresses matches the client's IP address, then the client is
1224authorized by CSA. If there are target IP addresses but none of them match
1225then the client is using an unauthorized IP address. If there are no target IP
1226addresses then the client cannot be using an authorized IP address. (This is
1227an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1228
1229Arguments:
1230 dnsa the DNS answer block
1231 dnss a DNS scan block for us to use
4c04137d 1232 reset option specifying what portion to scan, as described above
e5a9dba6
PH
1233 target the target hostname to use for matching RR names
1234
1235Returns: CSA_OK successfully authorized
1236 CSA_FAIL_MISMATCH addresses found but none matched
1237 CSA_FAIL_NOADDR no target addresses found
1238*/
1239
1240static int
1241acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1242 uschar *target)
1243{
d7978c0f 1244int rc = CSA_FAIL_NOADDR;
e5a9dba6 1245
d7978c0f
JH
1246for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1247 rr;
e5a9dba6
PH
1248 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1249 {
1250 /* Check this is an address RR for the target hostname. */
1251
1252 if (rr->type != T_A
1253 #if HAVE_IPV6
1254 && rr->type != T_AAAA
e5a9dba6
PH
1255 #endif
1256 ) continue;
1257
1258 if (strcmpic(target, rr->name) != 0) continue;
1259
d7978c0f 1260 rc = CSA_FAIL_MISMATCH;
e5a9dba6
PH
1261
1262 /* Turn the target address RR into a list of textual IP addresses and scan
1263 the list. There may be more than one if it is an A6 RR. */
1264
d7978c0f 1265 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
e5a9dba6
PH
1266 {
1267 /* If the client IP address matches the target IP address, it's good! */
1268
e1d04f48 1269 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
e5a9dba6
PH
1270
1271 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1272 }
1273 }
1274
1275/* If we found some target addresses but none of them matched, the client is
1276using an unauthorized IP address, otherwise the target has no authorized IP
1277addresses. */
1278
d7978c0f 1279return rc;
e5a9dba6
PH
1280}
1281
1282
1283
1284/*************************************************
1285* Verify Client SMTP Authorization *
1286*************************************************/
1287
1288/* Called from acl_verify() below. This routine calls dns_lookup_special()
1289to find the CSA SRV record corresponding to the domain argument, or
1290$sender_helo_name if no argument is provided. It then checks that the
1291client is authorized, and that its IP address corresponds to the SRV
1292target's address by calling acl_verify_csa_address() above. The address
1293should have been returned in the DNS response's ADDITIONAL section, but if
1294not we perform another DNS lookup to get it.
1295
1296Arguments:
1297 domain pointer to optional parameter following verify = csa
1298
1299Returns: CSA_UNKNOWN no valid CSA record found
1300 CSA_OK successfully authorized
1301 CSA_FAIL_* client is definitely not authorized
1302 CSA_DEFER_* there was a DNS problem
1303*/
1304
1305static int
55414b25 1306acl_verify_csa(const uschar *domain)
e5a9dba6
PH
1307{
1308tree_node *t;
55414b25 1309const uschar *found;
e5a9dba6 1310int priority, weight, port;
8743d3ac 1311dns_answer * dnsa = store_get_dns_answer();
e5a9dba6
PH
1312dns_scan dnss;
1313dns_record *rr;
1314int rc, type;
1315uschar target[256];
1316
1317/* Work out the domain we are using for the CSA lookup. The default is the
1318client's HELO domain. If the client has not said HELO, use its IP address
1319instead. If it's a local client (exim -bs), CSA isn't applicable. */
1320
1321while (isspace(*domain) && *domain != '\0') ++domain;
1322if (*domain == '\0') domain = sender_helo_name;
1323if (domain == NULL) domain = sender_host_address;
1324if (sender_host_address == NULL) return CSA_UNKNOWN;
1325
1326/* If we have an address literal, strip off the framing ready for turning it
1327into a domain. The framing consists of matched square brackets possibly
1328containing a keyword and a colon before the actual IP address. */
1329
1330if (domain[0] == '[')
1331 {
55414b25 1332 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH
1333 if (start == NULL) start = domain;
1334 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1335 }
1336
1337/* Turn domains that look like bare IP addresses into domains in the reverse
1338DNS. This code also deals with address literals and $sender_host_address. It's
1339not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1340address literals, but it's probably the most friendly thing to do. This is an
1341extension to CSA, so we allow it to be turned off for proper conformance. */
1342
7e66e54d 1343if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1344 {
1345 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
152481a0 1346 domain = dns_build_reverse(domain);
e5a9dba6
PH
1347 }
1348
1349/* Find out if we've already done the CSA check for this domain. If we have,
1350return the same result again. Otherwise build a new cached result structure
1351for this domain. The name is filled in now, and the value is filled in when
1352we return from this function. */
1353
1354t = tree_search(csa_cache, domain);
1355if (t != NULL) return t->data.val;
1356
f3ebb786 1357t = store_get_perm(sizeof(tree_node) + Ustrlen(domain), is_tainted(domain));
e5a9dba6
PH
1358Ustrcpy(t->name, domain);
1359(void)tree_insertnode(&csa_cache, t);
1360
1361/* Now we are ready to do the actual DNS lookup(s). */
1362
28e6ef29 1363found = domain;
8743d3ac 1364switch (dns_special_lookup(dnsa, domain, T_CSA, &found))
e5a9dba6
PH
1365 {
1366 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1367
1368 default:
1369 return t->data.val = CSA_DEFER_SRV;
1370
1371 /* If we found nothing, the client's authorization is unknown. */
1372
1373 case DNS_NOMATCH:
1374 case DNS_NODATA:
1375 return t->data.val = CSA_UNKNOWN;
1376
1377 /* We got something! Go on to look at the reply in more detail. */
1378
1379 case DNS_SUCCEED:
1380 break;
1381 }
1382
1383/* Scan the reply for well-formed CSA SRV records. */
1384
8743d3ac 1385for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
dd708fd7 1386 rr;
8743d3ac 1387 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
e5a9dba6 1388 {
dd708fd7 1389 const uschar * p = rr->data;
e5a9dba6
PH
1390
1391 /* Extract the numerical SRV fields (p is incremented) */
1392
e5a9dba6
PH
1393 GETSHORT(priority, p);
1394 GETSHORT(weight, p);
1395 GETSHORT(port, p);
1396
1397 DEBUG(D_acl)
e1d04f48 1398 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
e5a9dba6
PH
1399
1400 /* Check the CSA version number */
1401
1402 if (priority != 1) continue;
1403
1404 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1405 found by dns_special_lookup() is a parent of the one we asked for), we check
1406 the subdomain assertions in the port field. At the moment there's only one
1407 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1408 SRV records of their own. */
1409
1dc92d5a 1410 if (Ustrcmp(found, domain) != 0)
dd708fd7 1411 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
e5a9dba6
PH
1412
1413 /* This CSA SRV record refers directly to our domain, so we check the value
1414 in the weight field to work out the domain's authorization. 0 and 1 are
1415 unauthorized; 3 means the client is authorized but we can't check the IP
1416 address in order to authenticate it, so we treat it as unknown; values
1417 greater than 3 are undefined. */
1418
1419 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1420
1421 if (weight > 2) continue;
1422
1423 /* Weight == 2, which means the domain is authorized. We must check that the
1424 client's IP address is listed as one of the SRV target addresses. Save the
1425 target hostname then break to scan the additional data for its addresses. */
1426
8743d3ac 1427 (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
e5a9dba6
PH
1428 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1429
e1d04f48 1430 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
e5a9dba6
PH
1431
1432 break;
1433 }
1434
1435/* If we didn't break the loop then no appropriate records were found. */
1436
d7978c0f 1437if (!rr) return t->data.val = CSA_UNKNOWN;
e5a9dba6
PH
1438
1439/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1440A target of "." indicates there are no valid addresses, so the client cannot
1441be authorized. (This is an odd configuration because weight=2 target=. is
1442equivalent to weight=1, but we check for it in order to keep load off the
1443root name servers.) Note that dn_expand() turns "." into "". */
1444
1445if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1446
1447/* Scan the additional section of the CSA SRV reply for addresses belonging
1448to the target. If the name server didn't return any additional data (e.g.
1449because it does not fully support SRV records), we need to do another lookup
1450to obtain the target addresses; otherwise we have a definitive result. */
1451
8743d3ac 1452rc = acl_verify_csa_address(dnsa, &dnss, RESET_ADDITIONAL, target);
e5a9dba6
PH
1453if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1454
1455/* The DNS lookup type corresponds to the IP version used by the client. */
1456
1457#if HAVE_IPV6
1458if (Ustrchr(sender_host_address, ':') != NULL)
1459 type = T_AAAA;
1460else
1461#endif /* HAVE_IPV6 */
1462 type = T_A;
1463
1464
4e0983dc 1465lookup_dnssec_authenticated = NULL;
8743d3ac 1466switch (dns_lookup(dnsa, target, type, NULL))
e5a9dba6
PH
1467 {
1468 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1469
1470 default:
cc00f4af 1471 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH
1472
1473 /* If the query succeeded, scan the addresses and return the result. */
1474
1475 case DNS_SUCCEED:
8743d3ac 1476 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ANSWERS, target);
cc00f4af
JH
1477 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1478 /* else fall through */
e5a9dba6
PH
1479
1480 /* If the target has no IP addresses, the client cannot have an authorized
1481 IP address. However, if the target site uses A6 records (not AAAA records)
1482 we have to do yet another lookup in order to check them. */
1483
1484 case DNS_NOMATCH:
1485 case DNS_NODATA:
cc00f4af 1486 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH
1487 }
1488}
1489
1490
1491
1492/*************************************************
059ec3d9
PH
1493* Handle verification (address & other) *
1494*************************************************/
1495
89583014 1496enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd 1497 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
e3a69b62 1498 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
89583014
JH
1499 };
1500typedef struct {
1501 uschar * name;
1502 int value;
1503 unsigned where_allowed; /* bitmap */
1504 BOOL no_options; /* Never has /option(s) following */
1505 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1506 } verify_type_t;
1507static verify_type_t verify_type_list[] = {
6d95688d
JH
1508 /* name value where no-opt opt-sep */
1509 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, (unsigned)~0, FALSE, 0 },
1510 { US"certificate", VERIFY_CERT, (unsigned)~0, TRUE, 0 },
1511 { US"helo", VERIFY_HELO, (unsigned)~0, TRUE, 0 },
1512 { US"csa", VERIFY_CSA, (unsigned)~0, FALSE, 0 },
e3a69b62 1513 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
7c498df1 1514 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
e3a69b62
JH
1515 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1516 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1517 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
89583014 1518 FALSE, 6 },
e3a69b62
JH
1519 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1520 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1521#ifdef EXPERIMENTAL_ARC
f48946eb 1522 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
e3a69b62 1523#endif
89583014
JH
1524 };
1525
1526
1527enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1528 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1529 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
57cc2785 1530 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
89583014
JH
1531 };
1532typedef struct {
1533 uschar * name;
1534 int value;
1535 int flag;
1536 BOOL has_option; /* Has =option(s) following */
1537 BOOL timeval; /* Has a time value */
1538 } callout_opt_t;
1539static callout_opt_t callout_opt_list[] = {
f2ed27cf 1540 /* name value flag has-opt has-time */
89583014
JH
1541 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1542 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1543 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1544 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1545 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1546 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1547 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1548 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1549 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1550 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1551 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
57cc2785 1552 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
89583014
JH
1553 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1554 };
1555
1556
1557
059ec3d9
PH
1558/* This function implements the "verify" condition. It is called when
1559encountered in any ACL, because some tests are almost always permitted. Some
1560just don't make sense, and always fail (for example, an attempt to test a host
1561lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1562
1563Arguments:
1564 where where called from
1565 addr the recipient address that the ACL is handling, or NULL
1566 arg the argument of "verify"
1567 user_msgptr pointer for user message
1568 log_msgptr pointer for log message
1569 basic_errno where to put verify errno
1570
1571Returns: OK verification condition succeeded
1572 FAIL verification failed
1573 DEFER there was a problem verifying
1574 ERROR syntax error
1575*/
1576
1577static int
55414b25 1578acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH
1579 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1580{
1581int sep = '/';
1582int callout = -1;
1583int callout_overall = -1;
4deaf07d 1584int callout_connect = -1;
059ec3d9
PH
1585int verify_options = 0;
1586int rc;
1587BOOL verify_header_sender = FALSE;
1588BOOL defer_ok = FALSE;
1589BOOL callout_defer_ok = FALSE;
1590BOOL no_details = FALSE;
eafd343b 1591BOOL success_on_redirect = FALSE;
059ec3d9
PH
1592address_item *sender_vaddr = NULL;
1593uschar *verify_sender_address = NULL;
1594uschar *pm_mailfrom = NULL;
1595uschar *se_mailfrom = NULL;
596875b3
PH
1596
1597/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1598an error if options are given for items that don't expect them.
596875b3
PH
1599*/
1600
1601uschar *slash = Ustrchr(arg, '/');
55414b25 1602const uschar *list = arg;
ba74fb8d 1603uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
89583014 1604verify_type_t * vp;
059ec3d9 1605
e3a69b62 1606if (!ss) goto BAD_VERIFY;
059ec3d9
PH
1607
1608/* Handle name/address consistency verification in a separate function. */
1609
d7978c0f 1610for (vp = verify_type_list;
5903c6ff 1611 CS vp < CS verify_type_list + sizeof(verify_type_list);
89583014
JH
1612 vp++
1613 )
1614 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1615 : strcmpic (ss, vp->name) == 0)
1616 break;
5903c6ff 1617if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
89583014
JH
1618 goto BAD_VERIFY;
1619
e3a69b62 1620if (vp->no_options && slash)
059ec3d9 1621 {
89583014
JH
1622 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1623 "(this verify item has no options)", arg);
1624 return ERROR;
059ec3d9 1625 }
e3a69b62 1626if (!(vp->where_allowed & BIT(where)))
059ec3d9 1627 {
e3a69b62
JH
1628 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1629 vp->name, acl_wherenames[where]);
89583014 1630 return ERROR;
059ec3d9 1631 }
89583014 1632switch(vp->value)
596875b3 1633 {
89583014 1634 case VERIFY_REV_HOST_LKUP:
617d3932 1635 if (!sender_host_address) return OK;
7e8360e6 1636 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
617d3932 1637 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
7e8360e6
JH
1638 if (strcmpic(ss, US"defer_ok") == 0)
1639 return OK;
1640 return rc;
059ec3d9 1641
89583014
JH
1642 case VERIFY_CERT:
1643 /* TLS certificate verification is done at STARTTLS time; here we just
1644 test whether it was successful or not. (This is for optional verification; for
1645 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1646
3703d818
JH
1647 if (tls_in.certificate_verified) return OK;
1648 *user_msgptr = US"no verified certificate";
1649 return FAIL;
e5a9dba6 1650
89583014
JH
1651 case VERIFY_HELO:
1652 /* We can test the result of optional HELO verification that might have
1653 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1654
8768d548
JH
1655 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1656 return f.helo_verified ? OK : FAIL;
059ec3d9 1657
89583014
JH
1658 case VERIFY_CSA:
1659 /* Do Client SMTP Authorization checks in a separate function, and turn the
1660 result code into user-friendly strings. */
1c41c9cc 1661
3703d818
JH
1662 rc = acl_verify_csa(list);
1663 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1664 csa_reason_string[rc]);
3703d818 1665 csa_status = csa_status_string[rc];
e1d04f48 1666 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
3703d818 1667 return csa_return_code[rc];
89583014 1668
617d3932
JH
1669#ifdef EXPERIMENTAL_ARC
1670 case VERIFY_ARC:
1671 { /* Do Authenticated Received Chain checks in a separate function. */
1672 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1673 int csep = 0;
1674 uschar * cond;
1675
1676 if (!(arc_state = acl_verify_arc())) return DEFER;
93c931f8
JH
1677 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1678 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
617d3932
JH
1679
1680 if (!condlist) condlist = US"none:pass";
1681 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1682 if (Ustrcmp(arc_state, cond) == 0) return OK;
1683 return FAIL;
1684 }
1685#endif
1686
89583014 1687 case VERIFY_HDR_SYNTAX:
db57e575 1688 /* Check that all relevant header lines have the correct 5322-syntax. If there is
89583014
JH
1689 a syntax error, we return details of the error to the sender if configured to
1690 send out full details. (But a "message" setting on the ACL can override, as
1691 always). */
1692
1693 rc = verify_check_headers(log_msgptr);
3703d818
JH
1694 if (rc != OK && *log_msgptr)
1695 if (smtp_return_error_details)
1696 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1697 else
1698 acl_verify_message = *log_msgptr;
89583014 1699 return rc;
059ec3d9 1700
770747fd
MFM
1701 case VERIFY_HDR_NAMES_ASCII:
1702 /* Check that all header names are true 7 bit strings
1703 See RFC 5322, 2.2. and RFC 6532, 3. */
1704
1705 rc = verify_check_header_names_ascii(log_msgptr);
617d3932 1706 if (rc != OK && smtp_return_error_details && *log_msgptr)
770747fd
MFM
1707 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1708 return rc;
1709
89583014
JH
1710 case VERIFY_NOT_BLIND:
1711 /* Check that no recipient of this message is "blind", that is, every envelope
1712 recipient must be mentioned in either To: or Cc:. */
7c498df1
SA
1713 {
1714 BOOL case_sensitive = TRUE;
1715
1716 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1717 if (strcmpic(ss, US"case_insensitive") == 0)
1718 case_sensitive = FALSE;
1719 else
1720 {
1721 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1722 "condition \"verify %s\"", ss, arg);
1723 return ERROR;
1724 }
059ec3d9 1725
7c498df1 1726 if ((rc = verify_check_notblind(case_sensitive)) != OK)
89583014 1727 {
f3ebb786 1728 *log_msgptr = US"bcc recipient detected";
89583014
JH
1729 if (smtp_return_error_details)
1730 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1731 }
1732 return rc;
7c498df1 1733 }
059ec3d9 1734
89583014
JH
1735 /* The remaining verification tests check recipient and sender addresses,
1736 either from the envelope or from the header. There are a number of
1737 slash-separated options that are common to all of them. */
059ec3d9 1738
89583014
JH
1739 case VERIFY_HDR_SNDR:
1740 verify_header_sender = TRUE;
1741 break;
059ec3d9 1742
89583014
JH
1743 case VERIFY_SNDR:
1744 /* In the case of a sender, this can optionally be followed by an address to use
1745 in place of the actual sender (rare special-case requirement). */
059ec3d9 1746 {
89583014
JH
1747 uschar *s = ss + 6;
1748 if (*s == 0)
1749 verify_sender_address = sender_address;
1750 else
1751 {
1752 while (isspace(*s)) s++;
1753 if (*s++ != '=') goto BAD_VERIFY;
1754 while (isspace(*s)) s++;
1755 verify_sender_address = string_copy(s);
1756 }
059ec3d9 1757 }
89583014
JH
1758 break;
1759
1760 case VERIFY_RCPT:
1761 break;
059ec3d9
PH
1762 }
1763
89583014
JH
1764
1765
596875b3
PH
1766/* Remaining items are optional; they apply to sender and recipient
1767verification, including "header sender" verification. */
059ec3d9 1768
d7978c0f 1769while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
059ec3d9
PH
1770 {
1771 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1772 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1773 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1774
1775 /* These two old options are left for backwards compatibility */
1776
1777 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1778 {
1779 callout_defer_ok = TRUE;
1780 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1781 }
1782
1783 else if (strcmpic(ss, US"check_postmaster") == 0)
1784 {
1785 pm_mailfrom = US"";
1786 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1787 }
1788
1789 /* The callout option has a number of sub-options, comma separated */
1790
1791 else if (strncmpic(ss, US"callout", 7) == 0)
1792 {
1793 callout = CALLOUT_TIMEOUT_DEFAULT;
1794 ss += 7;
1795 if (*ss != 0)
1796 {
1797 while (isspace(*ss)) ss++;
1798 if (*ss++ == '=')
1799 {
55414b25 1800 const uschar * sublist = ss;
059ec3d9 1801 int optsep = ',';
059ec3d9 1802 uschar buffer[256];
d7978c0f 1803 uschar * opt;
8e669ac1 1804
d7978c0f 1805 while (isspace(*sublist)) sublist++;
57cc2785 1806 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
059ec3d9 1807 {
89583014 1808 callout_opt_t * op;
438257ba 1809 double period = 1.0F;
059ec3d9 1810
89583014 1811 for (op= callout_opt_list; op->name; op++)
438257ba 1812 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1813 break;
059ec3d9 1814
89583014
JH
1815 verify_options |= op->flag;
1816 if (op->has_option)
1817 {
438257ba 1818 opt += Ustrlen(op->name);
4deaf07d
PH
1819 while (isspace(*opt)) opt++;
1820 if (*opt++ != '=')
1821 {
1822 *log_msgptr = string_sprintf("'=' expected after "
89583014 1823 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH
1824 return ERROR;
1825 }
1826 while (isspace(*opt)) opt++;
89583014 1827 }
57cc2785 1828 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
89583014 1829 {
57cc2785
JH
1830 *log_msgptr = string_sprintf("bad time value in ACL condition "
1831 "\"verify %s\"", arg);
1832 return ERROR;
89583014
JH
1833 }
1834
1835 switch(op->value)
1836 {
1837 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1838 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1839 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1840 case CALLOUT_MAILFROM:
1841 if (!verify_header_sender)
1842 {
1843 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1844 "callout option only for verify=header_sender (detected in ACL "
1845 "condition \"%s\")", arg);
1846 return ERROR;
1847 }
1848 se_mailfrom = string_copy(opt);
1849 break;
1850 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1851 case CALLOUT_MAXWAIT: callout_overall = period; break;
1852 case CALLOUT_CONNECT: callout_connect = period; break;
1853 case CALLOUT_TIME: callout = period; break;
1854 }
059ec3d9
PH
1855 }
1856 }
1857 else
1858 {
1859 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1860 "ACL condition \"%s\"", arg);
1861 return ERROR;
1862 }
1863 }
1864 }
1865
1866 /* Option not recognized */
1867
1868 else
1869 {
1870 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1871 "condition \"verify %s\"", ss, arg);
1872 return ERROR;
1873 }
1874 }
1875
1876if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1877 (vopt_callout_recipsender|vopt_callout_recippmaster))
1878 {
1879 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1880 "for a recipient callout";
1881 return ERROR;
1882 }
1883
1884/* Handle sender-in-header verification. Default the user message to the log
1885message if giving out verification details. */
1886
1887if (verify_header_sender)
1888 {
8e669ac1 1889 int verrno;
2f682e45
JH
1890
1891 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 1892 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 1893 &verrno)) != OK)
8e669ac1 1894 {
fe5b5d0b
PH
1895 *basic_errno = verrno;
1896 if (smtp_return_error_details)
1897 {
2f682e45 1898 if (!*user_msgptr && *log_msgptr)
fe5b5d0b 1899 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
8768d548 1900 if (rc == DEFER) f.acl_temp_details = TRUE;
fe5b5d0b 1901 }
8e669ac1 1902 }
059ec3d9
PH
1903 }
1904
1905/* Handle a sender address. The default is to verify *the* sender address, but
1906optionally a different address can be given, for special requirements. If the
1907address is empty, we are dealing with a bounce message that has no sender, so
1908we cannot do any checking. If the real sender address gets rewritten during
1909verification (e.g. DNS widening), set the flag to stop it being rewritten again
1910during message reception.
1911
1912A list of verified "sender" addresses is kept to try to avoid doing to much
1913work repetitively when there are multiple recipients in a message and they all
1914require sender verification. However, when callouts are involved, it gets too
1915complicated because different recipients may require different callout options.
1916Therefore, we always do a full sender verify when any kind of callout is
1917specified. Caching elsewhere, for instance in the DNS resolver and in the
1918callout handling, should ensure that this is not terribly inefficient. */
1919
2f682e45 1920else if (verify_sender_address)
059ec3d9 1921 {
2f682e45 1922 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH
1923 {
1924 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1925 "sender verify callout";
1926 return ERROR;
1927 }
1928
1929 sender_vaddr = verify_checked_sender(verify_sender_address);
1930 if (sender_vaddr != NULL && /* Previously checked */
1931 callout <= 0) /* No callout needed this time */
1932 {
1933 /* If the "routed" flag is set, it means that routing worked before, so
1934 this check can give OK (the saved return code value, if set, belongs to a
1935 callout that was done previously). If the "routed" flag is not set, routing
1936 must have failed, so we use the saved return code. */
1937
2f682e45
JH
1938 if (testflag(sender_vaddr, af_verify_routed))
1939 rc = OK;
1940 else
059ec3d9
PH
1941 {
1942 rc = sender_vaddr->special_action;
1943 *basic_errno = sender_vaddr->basic_errno;
1944 }
e1d04f48 1945 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
059ec3d9
PH
1946 }
1947
1948 /* Do a new verification, and cache the result. The cache is used to avoid
1949 verifying the sender multiple times for multiple RCPTs when callouts are not
1950 specified (see comments above).
1951
1952 The cache is also used on failure to give details in response to the first
1953 RCPT that gets bounced for this reason. However, this can be suppressed by
1954 the no_details option, which sets the flag that says "this detail has already
1955 been sent". The cache normally contains just one address, but there may be
1956 more in esoteric circumstances. */
1957
1958 else
1959 {
1960 BOOL routed = TRUE;
2a3eea10 1961 uschar *save_address_data = deliver_address_data;
8e669ac1 1962
059ec3d9 1963 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 1964#ifdef SUPPORT_I18N
3c8b3577
JH
1965 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1966 {
1967 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1968 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1969 }
f358d5e0 1970#endif
059ec3d9
PH
1971 if (no_details) setflag(sender_vaddr, af_sverify_told);
1972 if (verify_sender_address[0] != 0)
1973 {
1974 /* If this is the real sender address, save the unrewritten version
1975 for use later in receive. Otherwise, set a flag so that rewriting the
1976 sender in verify_address() does not update sender_address. */
1977
1978 if (verify_sender_address == sender_address)
1979 sender_address_unrewritten = sender_address;
1980 else
1981 verify_options |= vopt_fake_sender;
1982
eafd343b
TK
1983 if (success_on_redirect)
1984 verify_options |= vopt_success_on_redirect;
1985
059ec3d9
PH
1986 /* The recipient, qualify, and expn options are never set in
1987 verify_options. */
1988
1989 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 1990 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9 1991
e1d04f48 1992 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
059ec3d9 1993
2f682e45
JH
1994 if (rc != OK)
1995 *basic_errno = sender_vaddr->basic_errno;
1996 else
1997 DEBUG(D_acl)
1998 {
1999 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
e1d04f48 2000 debug_printf_indent("sender %s verified ok as %s\n",
2f682e45
JH
2001 verify_sender_address, sender_vaddr->address);
2002 else
e1d04f48 2003 debug_printf_indent("sender %s verified ok\n",
2f682e45
JH
2004 verify_sender_address);
2005 }
059ec3d9 2006 }
2f682e45
JH
2007 else
2008 rc = OK; /* Null sender */
059ec3d9
PH
2009
2010 /* Cache the result code */
2011
2012 if (routed) setflag(sender_vaddr, af_verify_routed);
2013 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2014 sender_vaddr->special_action = rc;
2015 sender_vaddr->next = sender_verified_list;
2016 sender_verified_list = sender_vaddr;
8e669ac1
PH
2017
2018 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2019 the sender verification. */
8e669ac1 2020
2a3eea10 2021 deliver_address_data = save_address_data;
059ec3d9 2022 }
8e669ac1 2023
2a3eea10
PH
2024 /* Put the sender address_data value into $sender_address_data */
2025
d43cbe25 2026 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH
2027 }
2028
2029/* A recipient address just gets a straightforward verify; again we must handle
2030the DEFER overrides. */
2031
2032else
2033 {
2034 address_item addr2;
2035
eafd343b
TK
2036 if (success_on_redirect)
2037 verify_options |= vopt_success_on_redirect;
2038
059ec3d9
PH
2039 /* We must use a copy of the address for verification, because it might
2040 get rewritten. */
2041
2042 addr2 = *addr;
2043 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2044 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
e1d04f48 2045 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
8e669ac1 2046
42855d71 2047 *basic_errno = addr2.basic_errno;
059ec3d9 2048 *log_msgptr = addr2.message;
8e669ac1 2049 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2050 addr2.user_message : addr2.message;
42855d71
PH
2051
2052 /* Allow details for temporary error if the address is so flagged. */
8768d548 2053 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
059ec3d9
PH
2054
2055 /* Make $address_data visible */
d43cbe25 2056 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH
2057 }
2058
2059/* We have a result from the relevant test. Handle defer overrides first. */
2060
2061if (rc == DEFER && (defer_ok ||
2062 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2063 {
e1d04f48 2064 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
059ec3d9
PH
2065 defer_ok? "defer_ok" : "callout_defer_ok");
2066 rc = OK;
2067 }
2068
2069/* If we've failed a sender, set up a recipient message, and point
2070sender_verified_failed to the address item that actually failed. */
2071
2072if (rc != OK && verify_sender_address != NULL)
2073 {
2074 if (rc != DEFER)
059ec3d9 2075 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2076 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2077 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH
2078 else
2079 {
2080 *log_msgptr = US"Could not complete sender verify callout";
2081 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2082 *log_msgptr;
2083 }
2084
2085 sender_verified_failed = sender_vaddr;
2086 }
2087
2088/* Verifying an address messes up the values of $domain and $local_part,
2089so reset them before returning if this is a RCPT ACL. */
2090
2091if (addr != NULL)
2092 {
2093 deliver_domain = addr->domain;
2094 deliver_localpart = addr->local_part;
2095 }
2096return rc;
2097
2098/* Syntax errors in the verify argument come here. */
2099
2100BAD_VERIFY:
2101*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM
2102 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2103 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
2104 "\"verify %s\"", arg);
2105return ERROR;
2106}
2107
2108
2109
2110
2111/*************************************************
2112* Check argument for control= modifier *
2113*************************************************/
2114
cfe6f17c
JH
2115/* Called from acl_check_condition() below.
2116To handle the case "queue_only" we accept an _ in the
2117initial / option-switch position.
059ec3d9
PH
2118
2119Arguments:
2120 arg the argument string for control=
2121 pptr set to point to the terminating character
2122 where which ACL we are in
2123 log_msgptr for error messages
2124
2125Returns: CONTROL_xxx value
2126*/
2127
2128static int
55414b25 2129decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9 2130{
d7bed771
JH
2131int idx, len;
2132control_def * d;
cfe6f17c 2133uschar c;
059ec3d9 2134
d7bed771 2135if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
cfe6f17c
JH
2136 || ( (c = arg[len = Ustrlen((d = controls_list+idx)->name)]) != 0
2137 && (!d->has_option || c != '/' && c != '_')
d7bed771 2138 ) )
059ec3d9
PH
2139 {
2140 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2141 return CONTROL_ERROR;
2142 }
2143
059ec3d9 2144*pptr = arg + len;
d7bed771 2145return idx;
059ec3d9
PH
2146}
2147
2148
2149
c99ce5c9
TF
2150
2151/*************************************************
2152* Return a ratelimit error *
2153*************************************************/
2154
2155/* Called from acl_ratelimit() below
2156
2157Arguments:
2158 log_msgptr for error messages
2159 format format string
2160 ... supplementary arguments
c99ce5c9
TF
2161
2162Returns: ERROR
2163*/
2164
2165static int
2166ratelimit_error(uschar **log_msgptr, const char *format, ...)
2167{
2168va_list ap;
d12746bc
JH
2169gstring * g =
2170 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2171
c99ce5c9 2172va_start(ap, format);
f3ebb786 2173g = string_vformat(g, SVFMT_EXTEND|SVFMT_REBUFFER, format, ap);
c99ce5c9 2174va_end(ap);
d12746bc 2175
e59797e3 2176gstring_release_unused(g);
d12746bc 2177*log_msgptr = string_from_gstring(g);
c99ce5c9
TF
2178return ERROR;
2179}
2180
2181
2182
2183
059ec3d9 2184/*************************************************
870f6ba8
TF
2185* Handle rate limiting *
2186*************************************************/
2187
2188/* Called by acl_check_condition() below to calculate the result
2189of the ACL ratelimit condition.
2190
2191Note that the return value might be slightly unexpected: if the
2192sender's rate is above the limit then the result is OK. This is
2193similar to the dnslists condition, and is so that you can write
2194ACL clauses like: defer ratelimit = 15 / 1h
2195
2196Arguments:
2197 arg the option string for ratelimit=
90fc3069 2198 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2199 log_msgptr for error messages
2200
2201Returns: OK - Sender's rate is above limit
2202 FAIL - Sender's rate is below limit
2203 DEFER - Problem opening ratelimit database
2204 ERROR - Syntax error in options.
2205*/
2206
2207static int
55414b25 2208acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2209{
c99ce5c9 2210double limit, period, count;
8f240103
PH
2211uschar *ss;
2212uschar *key = NULL;
c99ce5c9 2213uschar *unique = NULL;
870f6ba8 2214int sep = '/';
c99ce5c9
TF
2215BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2216BOOL noupdate = FALSE, badacl = FALSE;
2217int mode = RATE_PER_WHAT;
870f6ba8
TF
2218int old_pool, rc;
2219tree_node **anchor, *t;
2220open_db dbblock, *dbm;
c99ce5c9 2221int dbdb_size;
870f6ba8 2222dbdata_ratelimit *dbd;
c99ce5c9 2223dbdata_ratelimit_unique *dbdb;
870f6ba8
TF
2224struct timeval tv;
2225
2226/* Parse the first two options and record their values in expansion
2227variables. These variables allow the configuration to have informative
2228error messages based on rate limits obtained from a table lookup. */
2229
c99ce5c9 2230/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF
2231size, which must be greater than or equal to zero. Zero is useful for
2232rate measurement as opposed to rate limiting. */
2233
65a32f85 2234if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
96f5fe4c
JH
2235 return ratelimit_error(log_msgptr, "sender rate limit not set");
2236
2237limit = Ustrtod(sender_rate_limit, &ss);
2238if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2239else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2240else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2241
c99ce5c9
TF
2242if (limit < 0.0 || *ss != '\0')
2243 return ratelimit_error(log_msgptr,
2244 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2245
c99ce5c9 2246/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF
2247constant. This must be strictly greater than zero, because zero leads to
2248run-time division errors. */
2249
65a32f85
JH
2250period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2251 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
870f6ba8 2252if (period <= 0.0)
c99ce5c9
TF
2253 return ratelimit_error(log_msgptr,
2254 "\"%s\" is not a time value", sender_rate_period);
2255
2256/* By default we are counting one of something, but the per_rcpt,
2257per_byte, and count options can change this. */
2258
2259count = 1.0;
870f6ba8 2260
c99ce5c9 2261/* Parse the other options. */
870f6ba8 2262
0d7a24c6 2263while ((ss = string_nextinlist(&arg, &sep, NULL, 0)))
870f6ba8
TF
2264 {
2265 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2266 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2267 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF
2268 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2269 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2270 else if (strcmpic(ss, US"per_conn") == 0)
2271 {
2272 RATE_SET(mode, PER_CONN);
2273 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2274 badacl = TRUE;
2275 }
2276 else if (strcmpic(ss, US"per_mail") == 0)
2277 {
2278 RATE_SET(mode, PER_MAIL);
2279 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2280 }
2281 else if (strcmpic(ss, US"per_rcpt") == 0)
2282 {
2283 /* If we are running in the RCPT ACL, then we'll count the recipients
2284 one by one, but if we are running when we have accumulated the whole
2285 list then we'll add them all in one batch. */
2286 if (where == ACL_WHERE_RCPT)
2287 RATE_SET(mode, PER_RCPT);
2288 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2289 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2290 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2291 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2292 }
2293 else if (strcmpic(ss, US"per_byte") == 0)
2294 {
2295 /* If we have not yet received the message data and there was no SIZE
4c04137d 2296 declaration on the MAIL command, then it's safe to just use a value of
c99ce5c9
TF
2297 zero and let the recorded rate decay as if nothing happened. */
2298 RATE_SET(mode, PER_MAIL);
2299 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
65a32f85 2300 else count = message_size < 0 ? 0.0 : (double)message_size;
c99ce5c9
TF
2301 }
2302 else if (strcmpic(ss, US"per_addr") == 0)
2303 {
2304 RATE_SET(mode, PER_RCPT);
438257ba 2305 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
65a32f85 2306 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
c99ce5c9
TF
2307 }
2308 else if (strncmpic(ss, US"count=", 6) == 0)
2309 {
2310 uschar *e;
2311 count = Ustrtod(ss+6, &e);
2312 if (count < 0.0 || *e != '\0')
65a32f85 2313 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
c99ce5c9
TF
2314 }
2315 else if (strncmpic(ss, US"unique=", 7) == 0)
2316 unique = string_copy(ss + 7);
65a32f85 2317 else if (!key)
c99ce5c9
TF
2318 key = string_copy(ss);
2319 else
2320 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF
2321 }
2322
c99ce5c9
TF
2323/* Sanity check. When the badacl flag is set the update mode must either
2324be readonly (which is the default if it is omitted) or, for backwards
2325compatibility, a combination of noupdate and strict or leaky. */
2326
2327if (mode == RATE_PER_CLASH)
2328 return ratelimit_error(log_msgptr, "conflicting per_* options");
2329if (leaky + strict + readonly > 1)
2330 return ratelimit_error(log_msgptr, "conflicting update modes");
2331if (badacl && (leaky || strict) && !noupdate)
2332 return ratelimit_error(log_msgptr,
bfe6da19 2333 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
c99ce5c9
TF
2334 ratelimit_option_string[mode], acl_wherenames[where]);
2335
2336/* Set the default values of any unset options. In readonly mode we
2337perform the rate computation without any increment so that its value
2338decays to eventually allow over-limit senders through. */
2339
2340if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2341if (badacl) readonly = TRUE;
2342if (readonly) count = 0.0;
2343if (!strict && !readonly) leaky = TRUE;
2344if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2345
8f240103
PH
2346/* Create the lookup key. If there is no explicit key, use sender_host_address.
2347If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2348omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2349are added to the key because they alter the meaning of the stored data. */
2350
65a32f85
JH
2351if (!key)
2352 key = !sender_host_address ? US"" : sender_host_address;
870f6ba8 2353
c99ce5c9 2354key = string_sprintf("%s/%s/%s%s",
8f240103 2355 sender_rate_period,
c99ce5c9
TF
2356 ratelimit_option_string[mode],
2357 unique == NULL ? "" : "unique/",
8f240103 2358 key);
870f6ba8 2359
c99ce5c9 2360HDEBUG(D_acl)
e1d04f48 2361 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2362
8f240103
PH
2363/* See if we have already computed the rate by looking in the relevant tree.
2364For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF
2365pool so that they survive across resets. In readonly mode we only remember the
2366result for the rest of this command in case a later command changes it. After
2367this bit of logic the code is independent of the per_* mode. */
870f6ba8 2368
870f6ba8
TF
2369old_pool = store_pool;
2370
c99ce5c9
TF
2371if (readonly)
2372 anchor = &ratelimiters_cmd;
65a32f85
JH
2373else switch(mode)
2374 {
2375 case RATE_PER_CONN:
2376 anchor = &ratelimiters_conn;
2377 store_pool = POOL_PERM;
2378 break;
2379 case RATE_PER_BYTE:
2380 case RATE_PER_MAIL:
2381 case RATE_PER_ALLRCPTS:
2382 anchor = &ratelimiters_mail;
2383 break;
2384 case RATE_PER_ADDR:
2385 case RATE_PER_CMD:
2386 case RATE_PER_RCPT:
2387 anchor = &ratelimiters_cmd;
2388 break;
2389 default:
2390 anchor = NULL; /* silence an "unused" complaint */
2391 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2392 "internal ACL error: unknown ratelimit mode %d", mode);
2393 break;
2394 }
870f6ba8 2395
65a32f85 2396if ((t = tree_search(*anchor, key)))
870f6ba8
TF
2397 {
2398 dbd = t->data.ptr;
2399 /* The following few lines duplicate some of the code below. */
8f240103 2400 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2401 store_pool = old_pool;
2402 sender_rate = string_sprintf("%.1f", dbd->rate);
2403 HDEBUG(D_acl)
e1d04f48 2404 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
870f6ba8
TF
2405 return rc;
2406 }
2407
c99ce5c9
TF
2408/* We aren't using a pre-computed rate, so get a previously recorded rate
2409from the database, which will be updated and written back if required. */
870f6ba8 2410
b10c87b3 2411if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE, TRUE)))
870f6ba8
TF
2412 {
2413 store_pool = old_pool;
2414 sender_rate = NULL;
e1d04f48 2415 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
870f6ba8
TF
2416 *log_msgptr = US"ratelimit database not available";
2417 return DEFER;
2418 }
c99ce5c9
TF
2419dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2420dbd = NULL;
870f6ba8
TF
2421
2422gettimeofday(&tv, NULL);
2423
65a32f85 2424if (dbdb)
c99ce5c9
TF
2425 {
2426 /* Locate the basic ratelimit block inside the DB data. */
e1d04f48 2427 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
c99ce5c9
TF
2428 dbd = &dbdb->dbd;
2429
2430 /* Forget the old Bloom filter if it is too old, so that we count each
2431 repeating event once per period. We don't simply clear and re-use the old
2432 filter because we want its size to change if the limit changes. Note that
2433 we keep the dbd pointer for copying the rate into the new data block. */
2434
65a32f85 2435 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
c99ce5c9 2436 {
e1d04f48 2437 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
c99ce5c9
TF
2438 dbdb = NULL;
2439 }
2440
2441 /* Sanity check. */
2442
65a32f85 2443 if(unique && dbdb_size < sizeof(*dbdb))
c99ce5c9 2444 {
e1d04f48 2445 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
c99ce5c9
TF
2446 dbdb = NULL;
2447 }
2448 }
2449
2450/* Allocate a new data block if the database lookup failed
2451or the Bloom filter passed its age limit. */
2452
65a32f85 2453if (!dbdb)
c99ce5c9 2454 {
65a32f85 2455 if (!unique)
c99ce5c9
TF
2456 {
2457 /* No Bloom filter. This basic ratelimit block is initialized below. */
e1d04f48 2458 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
c99ce5c9 2459 dbdb_size = sizeof(*dbd);
f3ebb786 2460 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
c99ce5c9
TF
2461 }
2462 else
2463 {
2464 int extra;
e1d04f48 2465 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
c99ce5c9
TF
2466
2467 /* See the long comment below for an explanation of the magic number 2.
2468 The filter has a minimum size in case the rate limit is very small;
2469 this is determined by the definition of dbdata_ratelimit_unique. */
2470
2471 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2472 if (extra < 0) extra = 0;
2473 dbdb_size = sizeof(*dbdb) + extra;
f3ebb786 2474 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
c99ce5c9
TF
2475 dbdb->bloom_epoch = tv.tv_sec;
2476 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2477 memset(dbdb->bloom, 0, dbdb->bloom_size);
2478
2479 /* Preserve any basic ratelimit data (which is our longer-term memory)
2480 by copying it from the discarded block. */
2481
65a32f85 2482 if (dbd)
c99ce5c9
TF
2483 {
2484 dbdb->dbd = *dbd;
2485 dbd = &dbdb->dbd;
2486 }
2487 }
2488 }
2489
2490/* If we are counting unique events, find out if this event is new or not.
2491If the client repeats the event during the current period then it should be
2492counted. We skip this code in readonly mode for efficiency, because any
2493changes to the filter will be discarded and because count is already set to
2494zero. */
2495
65a32f85 2496if (unique && !readonly)
c99ce5c9
TF
2497 {
2498 /* We identify unique events using a Bloom filter. (You can find my
2499 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2500 With the per_addr option, an "event" is a recipient address, though the
2501 user can use the unique option to define their own events. We only count
2502 an event if we have not seen it before.
2503
2504 We size the filter according to the rate limit, which (in leaky mode)
2505 is the limit on the population of the filter. We allow 16 bits of space
2506 per entry (see the construction code above) and we set (up to) 8 of them
2507 when inserting an element (see the loop below). The probability of a false
2508 positive (an event we have not seen before but which we fail to count) is
2509
2510 size = limit * 16
2511 numhash = 8
2512 allzero = exp(-numhash * pop / size)
2513 = exp(-0.5 * pop / limit)
2514 fpr = pow(1 - allzero, numhash)
2515
2516 For senders at the limit the fpr is 0.06% or 1 in 1700
2517 and for senders at half the limit it is 0.0006% or 1 in 170000
2518
2519 In strict mode the Bloom filter can fill up beyond the normal limit, in
2520 which case the false positive rate will rise. This means that the
2521 measured rate for very fast senders can bogusly drop off after a while.
2522
2523 At twice the limit, the fpr is 2.5% or 1 in 40
2524 At four times the limit, it is 31% or 1 in 3.2
2525
2526 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2527 decay below the limit, and if this is more than one then the Bloom filter
2528 will be discarded before the decay gets that far. The false positive rate
2529 at this threshold is 9.3% or 1 in 10.7. */
2530
2531 BOOL seen;
2532 unsigned n, hash, hinc;
2533 uschar md5sum[16];
2534 md5 md5info;
2535
2536 /* Instead of using eight independent hash values, we combine two values
2537 using the formula h1 + n * h2. This does not harm the Bloom filter's
2538 performance, and means the amount of hash we need is independent of the
2539 number of bits we set in the filter. */
2540
2541 md5_start(&md5info);
2542 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2543 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2544 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2545
2546 /* Scan the bits corresponding to this event. A zero bit means we have
2547 not seen it before. Ensure all bits are set to record this event. */
2548
e1d04f48 2549 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
c99ce5c9
TF
2550
2551 seen = TRUE;
2552 for (n = 0; n < 8; n++, hash += hinc)
2553 {
2554 int bit = 1 << (hash % 8);
2555 int byte = (hash / 8) % dbdb->bloom_size;
2556 if ((dbdb->bloom[byte] & bit) == 0)
2557 {
2558 dbdb->bloom[byte] |= bit;
2559 seen = FALSE;
2560 }
2561 }
2562
2563 /* If this event has occurred before, do not count it. */
2564
2565 if (seen)
2566 {
e1d04f48 2567 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
c99ce5c9
TF
2568 count = 0.0;
2569 }
2570 else
e1d04f48 2571 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
c99ce5c9
TF
2572 }
2573
2574/* If there was no previous ratelimit data block for this key, initialize
2575the new one, otherwise update the block from the database. The initial rate
2576is what would be computed by the code below for an infinite interval. */
2577
65a32f85 2578if (!dbd)
870f6ba8 2579 {
e1d04f48 2580 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
c99ce5c9 2581 dbd = &dbdb->dbd;
870f6ba8
TF
2582 dbd->time_stamp = tv.tv_sec;
2583 dbd->time_usec = tv.tv_usec;
c99ce5c9 2584 dbd->rate = count;
870f6ba8
TF
2585 }
2586else
2587 {
2588 /* The smoothed rate is computed using an exponentially weighted moving
2589 average adjusted for variable sampling intervals. The standard EWMA for
2590 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2591 where f() is the measured value and f'() is the smoothed value.
2592
2593 Old data decays out of the smoothed value exponentially, such that data n
2594 samples old is multiplied by a^n. The exponential decay time constant p
2595 is defined such that data p samples old is multiplied by 1/e, which means
2596 that a = exp(-1/p). We can maintain the same time constant for a variable
2597 sampling interval i by using a = exp(-i/p).
2598
2599 The rate we are measuring is messages per period, suitable for directly
2600 comparing with the limit. The average rate between now and the previous
2601 message is period / interval, which we feed into the EWMA as the sample.
2602
2603 It turns out that the number of messages required for the smoothed rate
2604 to reach the limit when they are sent in a burst is equal to the limit.
2605 This can be seen by analysing the value of the smoothed rate after N
2606 messages sent at even intervals. Let k = (1 - a) * p/i
2607
2608 rate_1 = (1 - a) * p/i + a * rate_0
2609 = k + a * rate_0
2610 rate_2 = k + a * rate_1
2611 = k + a * k + a^2 * rate_0
2612 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2613 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2614 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2615 = rate_0 * a^N + p/i * (1 - a^N)
2616
2617 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2618
2619 rate_N = p/i + (rate_0 - p/i) * a^N
2620 a^N = (rate_N - p/i) / (rate_0 - p/i)
2621 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2622 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2623
2624 Numerical analysis of the above equation, setting the computed rate to
2625 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2626 rates, p/i, the number of messages N = limit. So limit serves as both the
2627 maximum rate measured in messages per period, and the maximum number of
2628 messages that can be sent in a fast burst. */
2629
2630 double this_time = (double)tv.tv_sec
2631 + (double)tv.tv_usec / 1000000.0;
2632 double prev_time = (double)dbd->time_stamp
2633 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2634
2635 /* We must avoid division by zero, and deal gracefully with the clock going
2636 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2637 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2638
e5d5a95f
TF
2639 double interval = this_time - prev_time <= 0.0 ? 1e-9
2640 : this_time - prev_time;
2641
2642 double i_over_p = interval / period;
2643 double a = exp(-i_over_p);
870f6ba8 2644
c99ce5c9
TF
2645 /* Combine the instantaneous rate (period / interval) with the previous rate
2646 using the smoothing factor a. In order to measure sized events, multiply the
2647 instantaneous rate by the count of bytes or recipients etc. */
2648
870f6ba8
TF
2649 dbd->time_stamp = tv.tv_sec;
2650 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF
2651 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2652
2653 /* When events are very widely spaced the computed rate tends towards zero.
2654 Although this is accurate it turns out not to be useful for our purposes,
2655 especially when the first event after a long silence is the start of a spam
2656 run. A more useful model is that the rate for an isolated event should be the
2657 size of the event per the period size, ignoring the lack of events outside
2658 the current period and regardless of where the event falls in the period. So,
2659 if the interval was so long that the calculated rate is unhelpfully small, we
4c04137d 2660 re-initialize the rate. In the absence of higher-rate bursts, the condition
c99ce5c9
TF
2661 below is true if the interval is greater than the period. */
2662
2663 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF
2664 }
2665
c99ce5c9
TF
2666/* Clients sending at the limit are considered to be over the limit.
2667This matters for edge cases such as a limit of zero, when the client
2668should be completely blocked. */
3348576f 2669
65a32f85 2670rc = dbd->rate < limit ? FAIL : OK;
870f6ba8
TF
2671
2672/* Update the state if the rate is low or if we are being strict. If we
2673are in leaky mode and the sender's rate is too high, we do not update
2674the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF
2675rate preventing them from getting any email through. If readonly is set,
2676neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2677
c99ce5c9 2678if ((rc == FAIL && leaky) || strict)
8f240103 2679 {
c99ce5c9 2680 dbfn_write(dbm, key, dbdb, dbdb_size);
e1d04f48 2681 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
8f240103
PH
2682 }
2683else
2684 {
e1d04f48 2685 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
c99ce5c9 2686 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH
2687 }
2688
870f6ba8
TF
2689dbfn_close(dbm);
2690
f3ebb786
JH
2691/* Store the result in the tree for future reference. Take the taint status
2692from the key for consistency even though it's unlikely we'll ever expand this. */
870f6ba8 2693
f3ebb786 2694t = store_get(sizeof(tree_node) + Ustrlen(key), is_tainted(key));
c99ce5c9
TF
2695t->data.ptr = dbd;
2696Ustrcpy(t->name, key);
2697(void)tree_insertnode(anchor, t);
870f6ba8
TF
2698
2699/* We create the formatted version of the sender's rate very late in
2700order to ensure that it is done using the correct storage pool. */
2701
2702store_pool = old_pool;
2703sender_rate = string_sprintf("%.1f", dbd->rate);
2704
2705HDEBUG(D_acl)
e1d04f48 2706 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
870f6ba8
TF
2707
2708return rc;
2709}
2710
2711
2712
2713/*************************************************
b0019c78
TF
2714* The udpsend ACL modifier *
2715*************************************************/
2716
2717/* Called by acl_check_condition() below.
2718
2719Arguments:
2720 arg the option string for udpsend=
2721 log_msgptr for error messages
2722
2723Returns: OK - Completed.
2724 DEFER - Problem with DNS lookup.
2725 ERROR - Syntax error in options.
2726*/
2727
2728static int
55414b25 2729acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF
2730{
2731int sep = 0;
2732uschar *hostname;
2733uschar *portstr;
2734uschar *portend;
2735host_item *h;
2736int portnum;
b0019c78
TF
2737int len;
2738int r, s;
b1f8e4f8 2739uschar * errstr;
b0019c78
TF
2740
2741hostname = string_nextinlist(&arg, &sep, NULL, 0);
2742portstr = string_nextinlist(&arg, &sep, NULL, 0);
2743
f5d25c2b 2744if (!hostname)
b0019c78 2745 {
217b0e56 2746 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF
2747 return ERROR;
2748 }
f5d25c2b 2749if (!portstr)
b0019c78 2750 {
217b0e56 2751 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF
2752 return ERROR;
2753 }
f5d25c2b 2754if (!arg)
b0019c78 2755 {
217b0e56 2756 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF
2757 return ERROR;
2758 }
2759portnum = Ustrtol(portstr, &portend, 10);
2760if (*portend != '\0')
2761 {
217b0e56 2762 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF
2763 return ERROR;
2764 }
2765
2766/* Make a single-item host list. */
f3ebb786 2767h = store_get(sizeof(host_item), FALSE);
b0019c78
TF
2768memset(h, 0, sizeof(host_item));
2769h->name = hostname;
2770h->port = portnum;
2771h->mx = MX_NONE;
2772
2773if (string_is_ip_address(hostname, NULL))
2774 h->address = hostname, r = HOST_FOUND;
2775else
2776 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2777if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2778 {
217b0e56 2779 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF
2780 return DEFER;
2781 }
2782
2783HDEBUG(D_acl)
e1d04f48 2784 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
b0019c78 2785
4a5cbaff 2786/*XXX this could better use sendto */
b1f8e4f8 2787r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
4a5cbaff 2788 1, NULL, &errstr, NULL);
b0019c78 2789if (r < 0) goto defer;
27f9999e 2790len = Ustrlen(arg);
9cb1785a 2791r = send(s, arg, len, 0);
b1f8e4f8
JH
2792if (r < 0)
2793 {
2794 errstr = US strerror(errno);
2795 close(s);
2796 goto defer;
2797 }
2798close(s);
b0019c78
TF
2799if (r < len)
2800 {
2801 *log_msgptr =
2802 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2803 return DEFER;
2804 }
2805
2806HDEBUG(D_acl)
e1d04f48 2807 debug_printf_indent("udpsend %d bytes\n", r);
b0019c78
TF
2808
2809return OK;
2810
2811defer:
b1f8e4f8 2812*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF
2813return DEFER;
2814}
2815
2816
2817
2818/*************************************************
059ec3d9
PH
2819* Handle conditions/modifiers on an ACL item *
2820*************************************************/
2821
2822/* Called from acl_check() below.
2823
2824Arguments:
2825 verb ACL verb
2826 cb ACL condition block - if NULL, result is OK
2827 where where called from
2828 addr the address being checked for RCPT, or NULL
2829 level the nesting level
2830 epp pointer to pass back TRUE if "endpass" encountered
2831 (applies only to "accept" and "discard")
2832 user_msgptr user message pointer
2833 log_msgptr log message pointer
2834 basic_errno pointer to where to put verify error
2835
2836Returns: OK - all conditions are met
2837 DISCARD - an "acl" condition returned DISCARD - only allowed
2838 for "accept" or "discard" verbs
2839 FAIL - at least one condition fails
2840 FAIL_DROP - an "acl" condition returned FAIL_DROP
2841 DEFER - can't tell at the moment (typically, lookup defer,
2842 but can be temporary callout problem)
2843 ERROR - ERROR from nested ACL or expansion failure or other
2844 error
2845*/
2846
2847static int
2848acl_check_condition(int verb, acl_condition_block *cb, int where,
2849 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2850 uschar **log_msgptr, int *basic_errno)
2851{
2852uschar *user_message = NULL;
2853uschar *log_message = NULL;
059ec3d9 2854int rc = OK;
8523533c 2855#ifdef WITH_CONTENT_SCAN
0f0c8159 2856int sep = -'/';
8523533c 2857#endif
059ec3d9 2858
bce15b62 2859for (; cb; cb = cb->next)
059ec3d9 2860 {
55414b25 2861 const uschar *arg;
8e669ac1 2862 int control_type;
059ec3d9
PH
2863
2864 /* The message and log_message items set up messages to be used in
2865 case of rejection. They are expanded later. */
2866
2867 if (cb->type == ACLC_MESSAGE)
2868 {
e1d04f48 2869 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
059ec3d9
PH
2870 user_message = cb->arg;
2871 continue;
2872 }
2873
2874 if (cb->type == ACLC_LOG_MESSAGE)
2875 {
e1d04f48 2876 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
059ec3d9
PH
2877 log_message = cb->arg;
2878 continue;
2879 }
2880
2881 /* The endpass "condition" just sets a flag to show it occurred. This is
2882 checked at compile time to be on an "accept" or "discard" item. */
2883
2884 if (cb->type == ACLC_ENDPASS)
2885 {
2886 *epp = TRUE;
2887 continue;
2888 }
2889
2890 /* For other conditions and modifiers, the argument is expanded now for some
2891 of them, but not for all, because expansion happens down in some lower level
2892 checking functions in some cases. */
2893
560e71cc
JH
2894 if (!conditions[cb->type].expand_at_top)
2895 arg = cb->arg;
2896 else if (!(arg = expand_string(cb->arg)))
059ec3d9 2897 {
8768d548 2898 if (f.expand_string_forcedfail) continue;
560e71cc
JH
2899 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2900 cb->arg, expand_string_message);
8768d548 2901 return f.search_find_defer ? DEFER : ERROR;
059ec3d9 2902 }
059ec3d9
PH
2903
2904 /* Show condition, and expanded condition if it's different */
2905
2906 HDEBUG(D_acl)
2907 {
2908 int lhswidth = 0;
e1d04f48 2909 debug_printf_indent("check %s%s %n",
2d009132
JH
2910 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2911 conditions[cb->type].name, &lhswidth);
059ec3d9
PH
2912
2913 if (cb->type == ACLC_SET)
2914 {
a79d8834
JH
2915#ifndef DISABLE_DKIM
2916 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2917 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2918 {
2919 debug_printf("%s ", cb->u.varname);
2920 lhswidth += 19;
2921 }
2922 else
2923#endif
2924 {
2925 debug_printf("acl_%s ", cb->u.varname);
2926 lhswidth += 5 + Ustrlen(cb->u.varname);
2927 }
059ec3d9
PH
2928 }
2929
2930 debug_printf("= %s\n", cb->arg);
2931
2932 if (arg != cb->arg)
2933 debug_printf("%.*s= %s\n", lhswidth,
2934 US" ", CS arg);
2935 }
2936
2937 /* Check that this condition makes sense at this time */
2938
2d009132 2939 if ((conditions[cb->type].forbids & (1 << where)) != 0)
059ec3d9
PH
2940 {
2941 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2d009132
JH
2942 conditions[cb->type].is_modifier ? "use" : "test",
2943 conditions[cb->type].name, acl_wherenames[where]);
059ec3d9
PH
2944 return ERROR;
2945 }
2946
2947 /* Run the appropriate test for each condition, or take the appropriate
2948 action for the remaining modifiers. */
2949
2950 switch(cb->type)
2951 {
71fafd95
PH
2952 case ACLC_ADD_HEADER:
2953 setup_header(arg);
2954 break;
2955
059ec3d9
PH
2956 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2957 "discard" verb. */
71fafd95 2958
059ec3d9 2959 case ACLC_ACL:
e1d04f48 2960 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
7421ecab
JH
2961 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2962 {
2963 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2964 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2965 verbs[verb]);
2966 return ERROR;
2967 }
059ec3d9
PH
2968 break;
2969
2970 case ACLC_AUTHENTICATED:
c44ff8be
JH
2971 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2972 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
059ec3d9
PH
2973 break;
2974
71fafd95 2975 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
2976 case ACLC_BMI_OPTIN:
2977 {
2978 int old_pool = store_pool;
2979 store_pool = POOL_PERM;
2980 bmi_current_optin = string_copy(arg);
2981 store_pool = old_pool;
2982 }
2983 break;
71fafd95 2984 #endif
8523533c 2985
059ec3d9 2986 case ACLC_CONDITION:
f3766eb5
NM
2987 /* The true/false parsing here should be kept in sync with that used in
2988 expand.c when dealing with ECOND_BOOL so that we don't have too many
2989 different definitions of what can be a boolean. */
51c7471d
JH
2990 if (*arg == '-'
2991 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2992 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH
2993 rc = (Uatoi(arg) == 0)? FAIL : OK;
2994 else
2995 rc = (strcmpic(arg, US"no") == 0 ||
2996 strcmpic(arg, US"false") == 0)? FAIL :
2997 (strcmpic(arg, US"yes") == 0 ||
2998 strcmpic(arg, US"true") == 0)? OK : DEFER;
2999 if (rc == DEFER)
3000 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3001 break;
3002
c3611384
PH
3003 case ACLC_CONTINUE: /* Always succeeds */
3004 break;
3005
059ec3d9 3006 case ACLC_CONTROL:
c5fcb476 3007 {
55414b25
JH
3008 const uschar *p = NULL;
3009 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3010
55414b25 3011 /* Check if this control makes sense at this time */
f7572e5a 3012
d7bed771 3013 if (controls_list[control_type].forbids & (1 << where))
55414b25
JH
3014 {
3015 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
d7bed771 3016 controls_list[control_type].name, acl_wherenames[where]);
55414b25
JH
3017 return ERROR;
3018 }
8800895a 3019
55414b25
JH
3020 switch(control_type)
3021 {
3022 case CONTROL_AUTH_UNADVERTISED:
e851856f
JH
3023 f.allow_auth_unadvertised = TRUE;
3024 break;
55414b25 3025
e851856f 3026#ifdef EXPERIMENTAL_BRIGHTMAIL
55414b25 3027 case CONTROL_BMI_RUN:
e851856f
JH
3028 bmi_run = 1;
3029 break;
3030#endif
55414b25 3031
1a2e76e1 3032#ifndef DISABLE_DKIM
55414b25 3033 case CONTROL_DKIM_VERIFY:
e851856f 3034 f.dkim_disable_verify = TRUE;
1a2e76e1 3035# ifdef SUPPORT_DMARC
e851856f
JH
3036 /* Since DKIM was blocked, skip DMARC too */
3037 f.dmarc_disable_verify = TRUE;
3038 f.dmarc_enable_forensic = FALSE;
1a2e76e1 3039# endif
55414b25 3040 break;
1a2e76e1 3041#endif
55414b25 3042
1a2e76e1 3043#ifdef SUPPORT_DMARC
55414b25 3044 case CONTROL_DMARC_VERIFY:
e851856f
JH
3045 f.dmarc_disable_verify = TRUE;
3046 break;
55414b25
JH
3047
3048 case CONTROL_DMARC_FORENSIC:
e851856f
JH
3049 f.dmarc_enable_forensic = TRUE;
3050 break;
1a2e76e1 3051#endif
55414b25
JH
3052
3053 case CONTROL_DSCP:
e851856f 3054 if (*p == '/')
55414b25 3055 {
e851856f
JH
3056 int fd, af, level, optname, value;
3057 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3058 a socket; we can accept that, we'll just debug-log failures anyway. */
3059 fd = fileno(smtp_in);
3060 if ((af = ip_get_address_family(fd)) < 0)
55414b25 3061 {
e851856f
JH
3062 HDEBUG(D_acl)
3063 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3064 strerror(errno));
3065 break;
55414b25 3066 }
e851856f
JH
3067 if (dscp_lookup(p+1, af, &level, &optname, &value))
3068 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3069 {
3070 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3071 p+1, strerror(errno));
3072 }
3073 else
3074 {
3075 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3076 }
55414b25
JH
3077 else
3078 {
e851856f
JH
3079 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3080 return ERROR;
55414b25
JH
3081 }
3082 }
3083 else
3084 {
e851856f 3085 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
55414b25
JH
3086 return ERROR;
3087 }
e851856f 3088 break;
55414b25
JH
3089
3090 case CONTROL_ERROR:
e851856f 3091 return ERROR;
55414b25
JH
3092
3093 case CONTROL_CASEFUL_LOCAL_PART:
e851856f
JH
3094 deliver_localpart = addr->cc_local_part;
3095 break;
55414b25
JH
3096
3097 case CONTROL_CASELOWER_LOCAL_PART:
e851856f
JH
3098 deliver_localpart = addr->lc_local_part;
3099 break;
55414b25
JH
3100
3101 case CONTROL_ENFORCE_SYNC:
e851856f
JH
3102 smtp_enforce_sync = TRUE;
3103 break;
55414b25
JH
3104
3105 case CONTROL_NO_ENFORCE_SYNC:
e851856f
JH
3106 smtp_enforce_sync = FALSE;
3107 break;
55414b25 3108
e851856f 3109#ifdef WITH_CONTENT_SCAN
55414b25 3110 case CONTROL_NO_MBOX_UNSPOOL:
e851856f
JH
3111 f.no_mbox_unspool = TRUE;
3112 break;
3113#endif
55414b25
JH
3114
3115 case CONTROL_NO_MULTILINE:
e851856f
JH
3116 f.no_multiline_responses = TRUE;
3117 break;
55414b25
JH
3118
3119 case CONTROL_NO_PIPELINING:
e851856f
JH
3120 f.pipelining_enable = FALSE;
3121 break;
55414b25
JH
3122
3123 case CONTROL_NO_DELAY_FLUSH:
e851856f
JH
3124 f.disable_delay_flush = TRUE;
3125 break;
55414b25
JH
3126
3127 case CONTROL_NO_CALLOUT_FLUSH:
e851856f
JH
3128 f.disable_callout_flush = TRUE;
3129 break;
55414b25
JH
3130
3131 case CONTROL_FAKEREJECT:
e851856f
JH
3132 cancel_cutthrough_connection(TRUE, US"fakereject");
3133 case CONTROL_FAKEDEFER:
3134 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3135 if (*p == '/')
3136 {
3137 const uschar *pp = p + 1;
3138 while (*pp) pp++;
3139 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3140 p = pp;
3141 }
3142 else /* Explicitly reset to default string */
3143 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3144 break;
ed7f7860 3145
55414b25 3146 case CONTROL_FREEZE:
e851856f
JH
3147 f.deliver_freeze = TRUE;
3148 deliver_frozen_at = time(NULL);
3149 freeze_tell = freeze_tell_config; /* Reset to configured value */
3150 if (Ustrncmp(p, "/no_tell", 8) == 0)
3151 {
3152 p += 8;
3153 freeze_tell = NULL;
3154 }
3155 if (*p)
3156 {
3157 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3158 return ERROR;
3159 }
3160 cancel_cutthrough_connection(TRUE, US"item frozen");
3161 break;
55414b25 3162
9438970c 3163 case CONTROL_QUEUE:
e851856f 3164 f.queue_only_policy = TRUE;
cfe6f17c
JH
3165 if (Ustrcmp(p, "_only") == 0)
3166 p += 5;
3167 else while (*p == '/')
3168 if (Ustrncmp(p, "/only", 5) == 0)
3169 { p += 5; f.queue_smtp = FALSE; }
3170 else if (Ustrncmp(p, "/first_pass_route", 17) == 0)
3171 { p += 17; f.queue_smtp = TRUE; }
3172 else
3173 break;
e851856f
JH
3174 cancel_cutthrough_connection(TRUE, US"queueing forced");
3175 break;
55414b25
JH
3176
3177 case CONTROL_SUBMISSION:
e851856f
JH
3178 originator_name = US"";
3179 f.submission_mode = TRUE;
3180 while (*p == '/')
55414b25 3181 {
e851856f
JH
3182 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3183 {
3184 p += 14;
3185 f.active_local_sender_retain = TRUE;
3186 f.active_local_from_check = FALSE;
3187 }
3188 else if (Ustrncmp(p, "/domain=", 8) == 0)
3189 {
3190 const uschar *pp = p + 8;
3191 while (*pp && *pp != '/') pp++;
3192 submission_domain = string_copyn(p+8, pp-p-8);
3193 p = pp;
3194 }
3195 /* The name= option must be last, because it swallows the rest of
3196 the string. */
3197 else if (Ustrncmp(p, "/name=", 6) == 0)
3198 {
3199 const uschar *pp = p + 6;
3200 while (*pp) pp++;
3201 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3202 big_buffer, big_buffer_size));
3203 p = pp;
3204 }
3205 else break;
55414b25 3206 }
e851856f 3207 if (*p)
55414b25 3208 {
e851856f
JH
3209 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3210 return ERROR;
55414b25 3211 }
e851856f 3212 break;
e4bdf652 3213
55414b25 3214 case CONTROL_DEBUG:
55414b25 3215 {
b0d68adc
JH
3216 uschar * debug_tag = NULL;
3217 uschar * debug_opts = NULL;
3218 BOOL kill = FALSE;
3219
3220 while (*p == '/')
55414b25 3221 {
b0d68adc
JH
3222 const uschar * pp = p+1;
3223 if (Ustrncmp(pp, "tag=", 4) == 0)
3224 {
3225 for (pp += 4; *pp && *pp != '/';) pp++;
3226 debug_tag = string_copyn(p+5, pp-p-5);
3227 }
3228 else if (Ustrncmp(pp, "opts=", 5) == 0)
3229 {
3230 for (pp += 5; *pp && *pp != '/';) pp++;
3231 debug_opts = string_copyn(p+6, pp-p-6);
3232 }
3233 else if (Ustrncmp(pp, "kill", 4) == 0)
3234 {
3235 for (pp += 4; *pp && *pp != '/';) pp++;
3236 kill = TRUE;
3237 }
3238 else
3239 while (*pp && *pp != '/') pp++;
55414b25
JH
3240 p = pp;
3241 }
b0d68adc
JH
3242
3243 if (kill)
3244 debug_logging_stop();
3245 else
3246 debug_logging_activate(debug_tag, debug_opts);
e851856f 3247 break;
55414b25 3248 }
55414b25
JH
3249
3250 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
e851856f
JH
3251 f.suppress_local_fixups = TRUE;
3252 break;
55414b25
JH
3253
3254 case CONTROL_CUTTHROUGH_DELIVERY:
e851856f
JH
3255 {
3256 uschar * ignored = NULL;
a2b89db1 3257#ifndef DISABLE_PRDR
e851856f 3258 if (prdr_requested)
a2b89db1 3259#else
e851856f 3260 if (0)
a2b89db1 3261#endif
e851856f
JH
3262 /* Too hard to think about for now. We might in future cutthrough
3263 the case where both sides handle prdr and this-node prdr acl
3264 is "accept" */
3265 ignored = US"PRDR active";
55414b25
JH
3266 else
3267 {
e851856f
JH
3268 if (f.deliver_freeze)
3269 ignored = US"frozen";
3270 else if (f.queue_only_policy)
3271 ignored = US"queue-only";
3272 else if (fake_response == FAIL)
3273 ignored = US"fakereject";
3274 else
ff5929e3 3275 {
e851856f 3276 if (rcpt_count == 1)
ff5929e3 3277 {
e851856f
JH
3278 cutthrough.delivery = TRUE; /* control accepted */
3279 while (*p == '/')
ff5929e3 3280 {
e851856f
JH
3281 const uschar * pp = p+1;
3282 if (Ustrncmp(pp, "defer=", 6) == 0)
3283 {
3284 pp += 6;
3285 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3286 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3287 }
3288 else
3289 while (*pp && *pp != '/') pp++;
3290 p = pp;
ff5929e3 3291 }
ff5929e3 3292 }
e851856f
JH
3293 else
3294 ignored = US"nonfirst rcpt";
ff5929e3 3295 }
55414b25 3296 }
e851856f
JH
3297 DEBUG(D_acl) if (ignored)
3298 debug_printf(" cutthrough request ignored on %s item\n", ignored);
5032d1cf 3299 }
051d5efa 3300 break;
3c8b3577 3301
8c5d388a 3302#ifdef SUPPORT_I18N
3c8b3577 3303 case CONTROL_UTF8_DOWNCONVERT:
e851856f 3304 if (*p == '/')
921dfc11 3305 {
e851856f
JH
3306 if (p[1] == '1')
3307 {
3308 message_utf8_downconvert = 1;
3309 addr->prop.utf8_downcvt = TRUE;
3310 addr->prop.utf8_downcvt_maybe = FALSE;
3311 p += 2;
3312 break;
3313 }
3314 if (p[1] == '0')
3315 {
3316 message_utf8_downconvert = 0;
3317 addr->prop.utf8_downcvt = FALSE;
3318 addr->prop.utf8_downcvt_maybe = FALSE;
3319 p += 2;
3320 break;
3321 }
3322 if (p[1] == '-' && p[2] == '1')
3323 {
3324 message_utf8_downconvert = -1;
3325 addr->prop.utf8_downcvt = FALSE;
3326 addr->prop.utf8_downcvt_maybe = TRUE;
3327 p += 3;
3328 break;
3329 }
3330 *log_msgptr = US"bad option value for control=utf8_downconvert";
921dfc11 3331 }
e851856f 3332 else
921dfc11 3333 {
e851856f
JH
3334 message_utf8_downconvert = 1;
3335 addr->prop.utf8_downcvt = TRUE;
921dfc11 3336 addr->prop.utf8_downcvt_maybe = FALSE;
921dfc11
JH
3337 break;
3338 }
e851856f 3339 return ERROR;
8c5d388a 3340#endif
3c8b3577 3341
9171d434 3342 }
55414b25 3343 break;
059ec3d9 3344 }
059ec3d9 3345
6a8f9482
TK
3346 #ifdef EXPERIMENTAL_DCC
3347 case ACLC_DCC:
3348 {
4c04137d 3349 /* Separate the regular expression and any optional parameters. */
55414b25
JH
3350 const uschar * list = arg;
3351 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK
3352 /* Run the dcc backend. */
3353 rc = dcc_process(&ss);
4c04137d 3354 /* Modify return code based upon the existence of options. */
3c8b3577 3355 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3356 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3357 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK
3358 }
3359 break;
3360 #endif
3361
71fafd95 3362 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3363 case ACLC_DECODE:
3364 rc = mime_decode(&arg);
3365 break;
71fafd95 3366 #endif
8523533c 3367
059ec3d9
PH
3368 case ACLC_DELAY:
3369 {
3370 int delay = readconf_readtime(arg, 0, FALSE);
3371 if (delay < 0)
3372 {
3373 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3374 "modifier: \"%s\" is not a time value", arg);
3375 return ERROR;
3376 }
3377 else
3378 {
e1d04f48 3379 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
059ec3d9
PH
3380 delay);
3381 if (host_checking)
3382 {
3383 HDEBUG(D_acl)
e1d04f48 3384 debug_printf_indent("delay skipped in -bh checking mode\n");
059ec3d9 3385 }
010c2d14 3386
ae9d18bc
JH
3387 /* NOTE 1: Remember that we may be
3388 dealing with stdin/stdout here, in addition to TCP/IP connections.
3389 Also, delays may be specified for non-SMTP input, where smtp_out and
3390 smtp_in will be NULL. Whatever is done must work in all cases.
3391
3392 NOTE 2: The added feature of flushing the output before a delay must
3393 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3394 */
3395
3396 else
3397 {
02c30a32 3398 if (smtp_out && !f.disable_delay_flush)
ae9d18bc
JH
3399 mac_smtp_fflush();
3400
861a7c51 3401#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH
3402 {
3403 struct pollfd p;
3404 nfds_t n = 0;
3405 if (smtp_out)
3406 {
3407 p.fd = fileno(smtp_out);
3408 p.events = POLLRDHUP;
3409 n = 1;
3410 }
3411 if (poll(&p, n, delay*1000) > 0)
e1d04f48 3412 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
ae9d18bc
JH
3413 }
3414#else
02c30a32
JH
3415 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3416 TCP/IP connection has gone away without reading from it. This means
3417 that we cannot shorten the delay below if the client goes away,
3418 because we cannot discover that the client has closed its end of the
3419 connection. (The connection is actually in a half-closed state,
3420 waiting for the server to close its end.) It would be nice to be able
3421 to detect this state, so that the Exim process is not held up
3422 unnecessarily. However, it seems that we can't. The poll() function
3423 does not do the right thing, and in any case it is not always
3424 available. */
010c2d14 3425
86b8287f 3426 while (delay > 0) delay = sleep(delay);
ae9d18bc 3427#endif
8e669ac1 3428 }
059ec3d9
PH
3429 }
3430 }
3431 break;
3432
80a47a2c
TK
3433 #ifndef DISABLE_DKIM
3434 case ACLC_DKIM_SIGNER:
a79d8834 3435 if (dkim_cur_signer)
9e5d6b55 3436 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3437 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3438 else
b0b9dbb1 3439 rc = FAIL;
71fafd95
PH
3440 break;
3441
80a47a2c 3442 case ACLC_DKIM_STATUS:
a79d8834 3443 rc = match_isinlist(dkim_verify_status,
80a47a2c 3444 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH
3445 break;
3446 #endif
fb2274d4 3447
1a2e76e1 3448#ifdef SUPPORT_DMARC
4840604e 3449 case ACLC_DMARC_STATUS:
8768d548 3450 if (!f.dmarc_has_been_checked)
4840604e 3451 dmarc_process();
8768d548 3452 f.dmarc_has_been_checked = TRUE;
4840604e
TL
3453 /* used long way of dmarc_exim_expand_query() in case we need more
3454 * view into the process in the future. */
3455 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3456 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3457 break;
1a2e76e1 3458#endif
4840604e 3459
059ec3d9 3460 case ACLC_DNSLISTS:
379ba7d0 3461 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH
3462 break;
3463
3464 case ACLC_DOMAINS:
3465 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3466 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH
3467 break;
3468
3469 /* The value in tls_cipher is the full cipher name, for example,
3470 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3471 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3472 what may in practice come out of the SSL library - which at the time of
3473 writing is poorly documented. */
3474
3475 case ACLC_ENCRYPTED:
817d9f57 3476 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH
3477 {
3478